$showPasswordlessButton is deprecated
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Assigned To

Authored By

	Aklapper
	Jul 2 2026, 9:03 AM

Project Tags

Referenced Files

None

Subscribers

Description

Error

service.version: 1.47.0-wmf.9
timestamp: 2026-07-02T08:40:19.432Z
labels.phpversion: 8.3.31
trace.id: 0bce5253-06a4-431b-a2fc-214c578bcabe
Find trace.id in Logstash

labels.normalized_message

[{reqId}] {exception_url}   PHP Deprecated: Creation of dynamic property MediaWiki\Extension\OATHAuth\Auth\WebAuthnAuthenticationRequest::$showPrompt is deprecated

[{reqId}] {exception_url}   PHP Deprecated: Creation of dynamic property MediaWiki\Extension\OATHAuth\Auth\WebAuthnAuthenticationRequest::$showPasswordlessButton is deprecated

Frame	Location	Call
from	/srv/mediawiki/php-1.47.0-wmf.9/includes/Session/Session.php(557)
#0	[internal function]	MediaWiki\Exception\MWExceptionHandler::handleError(int, string, string, int)
#1	/srv/mediawiki/php-1.47.0-wmf.9/includes/Session/Session.php(557)	unserialize(string)
#2	/srv/mediawiki/php-1.47.0-wmf.9/includes/Auth/AuthManager.php(446)	MediaWiki\Session\Session->getSecret(string)
#3	/srv/mediawiki/php-1.47.0-wmf.9/includes/SpecialPage/AuthManagerSpecialPage.php(433)	MediaWiki\Auth\AuthManager->continueAuthentication(array)
#4	/srv/mediawiki/php-1.47.0-wmf.9/includes/SpecialPage/AuthManagerSpecialPage.php(566)	MediaWiki\SpecialPage\AuthManagerSpecialPage->performAuthenticationStep(string, array)
#5	/srv/mediawiki/php-1.47.0-wmf.9/includes/HTMLForm/HTMLForm.php(831)	MediaWiki\SpecialPage\AuthManagerSpecialPage->handleFormSubmit(array, MediaWiki\HTMLForm\CodexHTMLForm)
#6	/srv/mediawiki/php-1.47.0-wmf.9/includes/SpecialPage/AuthManagerSpecialPage.php(497)	MediaWiki\HTMLForm\HTMLForm->trySubmit()
#7	/srv/mediawiki/php-1.47.0-wmf.9/includes/SpecialPage/LoginSignupSpecialPage.php(415)	MediaWiki\SpecialPage\AuthManagerSpecialPage->trySubmit()
#8	/srv/mediawiki/php-1.47.0-wmf.9/includes/SpecialPage/SpecialPage.php(727)	MediaWiki\SpecialPage\LoginSignupSpecialPage->execute(null)
#9	/srv/mediawiki/php-1.47.0-wmf.9/includes/SpecialPage/SpecialPageFactory.php(1723)	MediaWiki\SpecialPage\SpecialPage->run(null)
#10	/srv/mediawiki/php-1.47.0-wmf.9/includes/Actions/ActionEntryPoint.php(505)	MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, MediaWiki\Context\RequestContext)
#11	/srv/mediawiki/php-1.47.0-wmf.9/includes/Actions/ActionEntryPoint.php(145)	MediaWiki\Actions\ActionEntryPoint->performRequest()
#12	/srv/mediawiki/php-1.47.0-wmf.9/includes/MediaWikiEntryPoint.php(180)	MediaWiki\Actions\ActionEntryPoint->execute()
#13	/srv/mediawiki/php-1.47.0-wmf.9/index.php(44)	MediaWiki\MediaWikiEntryPoint->run()
#14	/srv/mediawiki/w/index.php(3)	require(string)
#15	{main}

Impact

Unclear. These two errors each appear twice followed by one "Authentication failed because of inconsistent provider array" exception in Logstash.
Not rolling back the train because 6 occurrences in the last 30min.
But setting UBN as this may break auth for some users.

Notes

There is a third similar issue PHP Deprecated: Creation of dynamic property MediaWiki\Extension\OATHAuth\Auth\WebAuthnAuthenticationRequest::$options is deprecated in Logstash, but that is from old 1.47.0-wmf.8 and not current 1.47.0-wmf.9, so I kept it out of this for now.

Details

MediaWiki Version: 1.47.0-wmf.9
Request URL: https://auth.wikimedia.org/*wiki/w/index.php?centralauthLoginToken=*&returnto=*&title=*&useformat=*&usesul3=*

Related Objects

Mentioned In: T423918: 1.47.0-wmf.9 deployment blockers
Mentioned Here: rEOATdfff1d2c4275: Reauthentication: Skip directly to second factor when available
T427950: Simplify login form when reauthenticating

Event Timeline

Aklapper created this task.Jul 2 2026, 9:03 AM

Aklapper triaged this task as Unbreak Now! priority.

Aklapper mentioned this in T423918: 1.47.0-wmf.9 deployment blockers.Jul 2 2026, 9:11 AM

• thcipriani moved this task from Untriaged to Jul–Sep 2026 on the Wikimedia-production-error board.Jul 2 2026, 3:19 PM

Caused by rEOATdfff1d2c4275: Reauthentication: Skip directly to second factor when available for T427950: Simplify login form when reauthenticating...

I don't think this is a big issue, but it's due to I guess what turns out to be a change in seriali[sz]ation format...

Cached/seriali[sz]ed stuff before the wiki was upgraded? And/or across wikis with different versions?

They were changed from properties to indexes under options...

Two properties removed, one added...

Reedy moved this task from Backlog to Bugs on the MediaWiki-extensions-OATHAuth board.Jul 5 2026, 10:47 PM

Aklapper lowered the priority of this task from Unbreak Now! to Needs Triage.Jul 6 2026, 9:12 PM

"inconsistent provider array" is a normal byproduct of deploying code with new providers (AuthManager will abandon in-progress authentications out of precaution). As long as it only happens around the time of the deployment, it can be safely ignored.

Wrt "Creation of dynamic property", if the property is not used anymore in new code (and you are only seeing the error near the time of deployment), that can be ignored as well. Authentication requests are stored in the session, so cache entries won't be around for long.

In T430916#12099641, @Tgr wrote:

"inconsistent provider array" is a normal byproduct of deploying code with new providers (AuthManager will abandon in-progress authentications out of precaution). As long as it only happens around the time of the deployment, it can be safely ignored.

Wrt "Creation of dynamic property", if the property is not used anymore in new code (and you are only seeing the error near the time of deployment), that can be ignored as well. Authentication requests are stored in the session, so cache entries won't be around for long.

Ok, sounds good, I'll resolve this for now. The logs definitely make this seem like they were very transitory notices (showPrompt notices, showPasswordlessLogin notices).

sbassett added projects: Security-Team, SecTeam-Processed.Jul 8 2026, 2:35 PM

sbassett moved this task from Incoming to Our Part Is Done on the Security-Team board.

Authentication failed because of inconsistent provider array / PHP Deprecated: Creation of dynamic property Auth\WebAuthnAuthenticationRequest::$showPrompt / $showPasswordlessButton is deprecatedClosed, ResolvedPublicPRODUCTION ERRORActions