Use AuthPopup for reauth on EditPage
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	sbassett
	Jun 23 2026, 6:34 PM

Project Tags

Referenced Files

None

Subscribers

Description

Building on the work in T427955 et al, we should use AuthPopup as the default privilege elevation mechanism for the actual re-authentication event. DataStashTrait will still exist, for now, and be used for noJS/error fallback scenarios.

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	Use AuthPopup for reauth on EditPage	SBassett	mediawiki/core	master	+328 -29

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Open	None	T197160 All security-sensitive MediaWiki functionality should require elevated security
Resolved	sbassett	T427955 Prompt for reauthentication after submitting a site JS edit, not before
Resolved	sbassett	T429986 Use AuthPopup for reauth on EditPage

Event Timeline

sbassett created this task.Jun 23 2026, 6:34 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 23 2026, 6:34 PM

sbassett added a parent task: T427955: Prompt for reauthentication after submitting a site JS edit, not before.Jun 23 2026, 6:34 PM

sbassett added subscribers: Tgr, Catrope, Mstyles.

Tgr added a subscriber: matmarex.Jun 23 2026, 8:09 PM

Oh, nice! I experimented with this some time ago. AuthPopup currently only handles authentication, not re-authentication, so if you're logged in, it will just confirm that and close itself. It should be easy to change – the following hacky snippet worked for me locally, I'll leave it up to you how to integrate it into the code better:

const require = await mw.loader.using( 'mediawiki.authenticationPopup' );
const authPopup = require( 'mediawiki.authenticationPopup' );

// Hacky overrides so that this works while you're already logged in
authPopup.loginPopupUrl += '&force=editsitejscss';
authPopup.checkLoggedIn = async function () {
     const resp = await new mw.Api().get( {
         'action': 'query',
         'meta': 'authmanagerinfo',
         'amisecuritysensitiveoperation': 'editsitejscss'
     } );
     return resp.query.authmanagerinfo.securitysensitiveoperationstatus === 'ok';
}

authPopup.startPopupWindow();