When a sitekey mismatch occurs, the error log does not contain either what sitekey was used by the provided hCaptcha response and neither what sitekey(s) were considered acceptable for the submission. To aid in debugging the sitekeys should be logged. These are not private information, as we send them to the client so logging them is not an issue
Hello! I'd like to work on this task. I am currently looking into the implementation and plan to submit a patch for review.
Change #1305082 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):
[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Log sitekeys on a sitekey-mismatch error
@kostajh actually i implemented just submitting patch :(
(edit) no issues you can continue....
Sorry to hear it. Please double-check a task before you claim it -- you had claimed this one after it was already assigned to me. Thanks for your work, in any case.
Change #1305082 merged by jenkins-bot:
[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Log sitekeys on a sitekey-mismatch error
Change #1305092 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):
[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.8] hCaptcha: Log sitekeys on a sitekey-mismatch error
Change #1305092 merged by jenkins-bot:
[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.8] hCaptcha: Log sitekeys on a sitekey-mismatch error
Mentioned in SAL (#wikimedia-operations) [2026-06-23T11:29:43Z] <kharlan@deploy1003> Started scap sync-world: Backport for [[gerrit:1305092|hCaptcha: Log sitekeys on a sitekey-mismatch error (T429891)]]
Change #1305096 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):
[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.7] hCaptcha: Log sitekeys on a sitekey-mismatch error
Mentioned in SAL (#wikimedia-operations) [2026-06-23T11:31:47Z] <kharlan@deploy1003> kharlan: Backport for [[gerrit:1305092|hCaptcha: Log sitekeys on a sitekey-mismatch error (T429891)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Mentioned in SAL (#wikimedia-operations) [2026-06-23T11:36:20Z] <kharlan@deploy1003> Finished scap sync-world: Backport for [[gerrit:1305092|hCaptcha: Log sitekeys on a sitekey-mismatch error (T429891)]] (duration: 06m 37s)
Change #1305096 merged by jenkins-bot:
[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.7] hCaptcha: Log sitekeys on a sitekey-mismatch error
Mentioned in SAL (#wikimedia-operations) [2026-06-23T11:45:08Z] <kharlan@deploy1003> Started scap sync-world: Backport for [[gerrit:1305096|hCaptcha: Log sitekeys on a sitekey-mismatch error (T429891)]]
Mentioned in SAL (#wikimedia-operations) [2026-06-23T11:47:12Z] <kharlan@deploy1003> kharlan: Backport for [[gerrit:1305096|hCaptcha: Log sitekeys on a sitekey-mismatch error (T429891)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Mentioned in SAL (#wikimedia-operations) [2026-06-23T11:51:59Z] <kharlan@deploy1003> Finished scap sync-world: Backport for [[gerrit:1305096|hCaptcha: Log sitekeys on a sitekey-mismatch error (T429891)]] (duration: 06m 51s)
Sitekeys are being logged as expected and this helped us to find the bug T429902: ConfirmEdit 'badloginperuser' does not fallback to 'badlogin' CAPTCHA config