It gives me a 500 error with "The server said: Callback wasn't confirmed"
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| Parse form-encoded OAuth 1 token responses instead of format=json | C. Scott Ananian | mediawiki/oauthclient-php | master | +145 -35 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Release | jeena | T423917 1.47.0-wmf.8 deployment blockers | ||
| Resolved | Tgr | T430092 Wikimedia Global Search won't let me log in (all mediawiki/oauthclient users broken) |
Event Timeline
Comment Actions
On IRC it was said:
if its a oauth1 user, it appears there was a bit of a surprise breaking change
bawolfs comment in -tech
this was the change that was referenced
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OAuth/+/1304678
but i havnt seen any tasks popup
Maybe that's a hint?
Comment Actions
global search uses wikimedia/toolforge-bundle which uses mediawiki/oauthclient. And mediawiki/oauthclient uses format=json wouldn't you know.
Comment Actions
Looks like it is in the dependency https://github.com/wikimedia/mediawiki-oauthclient-php/blob/master/src/Client.php#L158
Comment Actions
Change #1305510 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):
[mediawiki/oauthclient-php@master] Parse form-encoded OAuth 1 token responses instead of format=json
Comment Actions
Elevating priority because this breaks 3rd party login (including wmf cloud login) to Wikimedia servers for all downstream apps using the mediawiki/oauthclient package (and there's quite a lot of dependencies of that in https://packagist.org/packages/mediawiki/oauthclient/dependents?order_by=downloads ).
Suggested fix is to backport the revert in Revert "Fix format=json option for OAuth 1" (1305512) · Gerrit Code Review to wmf.8.
At a more leisurely pace, the upstream mediawiki/oauthclient can be upgraded to avoid using format=json via Parse form-encoded OAuth 1 token responses instead of format=json (1305510) · Gerrit Code Review and enough downstream clients update, we could reply the patch to the OAuth extension.
Comment Actions
Broken in rEOAUfda4f89e4945: Fix format=json option for OAuth 1
Hopefully fixed in rEOAUf1d042007df1: Fix B/C break for OAuth 1 format=json option and rEOAUb1abc60d0f8d: Fix B/C break for OAuth 1 format=json option, round #2 (with the two patches applied, oauthclient-php works for me locally).
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2026-06-24T23:10:07Z] <tgr_> doing an emergency backport for T430092