Use mediawiki.cookie instead of jquery.cookie in MediaWiki-specific scripts
Closed, ResolvedPublic

Description

mediawiki.* modules should be using the new mediawiki.cookie module (added per T51156) instead of jquery.cookie. It provides correct defaults for cookie domain, path and expiration.

It also respects $wgCookiePrefix, which can cause issues when migrating. It doesn't look like the JavaScript code which uses cookies is critical enough for us not to be able to just switch to the new names directly.

Offenders in core include mediawiki.toc, mediawiki.user, mediawiki.action.edit.collapsibleFooter, mediawiki.special.changeslist.legend.js.
Right now none of them respects cookie prefix, none of them handles the domain or path correctly (some use path: '/'), and none of them use the correct expiration time.

Details

Reference
bz65384
bzimport raised the priority of this task from to Normal.
bzimport set Reference to bz65384.
bzimport added a subscriber: Unknown Object (MLST).
matmarex created this task.May 16 2014, 1:27 AM

It's possible to use mediawiki.cookie without changing the cookie names (e.g. for back-compat, or temporarily). All the settings are overridable.

Changing the name without backwards compatibility should not be an issue for the simple UI ones (e.g. TOC) (it will be slightly annoying once per UI item, which is acceptable). However, many of these may be better suited for localStorage. We have a wrapper for this, jStorage (side not, jStorage does not handle wgCookiePrefix, so it has to be done manually), which uses localStorage or various fallbacks.

Avoiding cookies in such cases (where the server doesn't need the data) saves bandwidth.

If it seems relevant to analytics (e.g. 'mediawiki.user.bucket', 'mediaWiki.user.sessionId', etc.), please notify the analytics list (https://lists.wikimedia.org/mailman/listinfo/analytics) before it's merged, so if someone has an experiment in progress, they can coordinate.

Finally, it's completely expected that there will be overrides for duration; the most common use case for this is a session cookie (null duration).

the most common use case for this is a session cookie (null duration).

Many other examples (e.g. 30 days from changeslist) should probably use wgCookieExpiration, though.

Unsubscribing, but feel free to add me to code review on this.

Change 176948 had a related patch set uploaded (by Nemo bis):
ResourceLoader: jquery.cookie changed to mediawiki.cookie

https://gerrit.wikimedia.org/r/176948

Patch-For-Review

Krinkle renamed this task from Core modules should use mediawiki.cookie instead of jquery.cookie to Use mediawiki.cookie instead of jquery.cookie.Dec 8 2014, 1:10 AM
Krinkle updated the task description. (Show Details)
Krinkle set Security to None.
Krinkle removed a subscriber: Unknown Object (MLST).
matmarex closed this task as Resolved.May 16 2015, 3:11 PM
matmarex removed a project: Patch-For-Review.

Change 176948 merged by jenkins-bot:
Convert mediawiki.toc and mediawiki.user to using mw.cookie

https://gerrit.wikimedia.org/r/176948

Change 211409 had a related patch set uploaded (by Bartosz Dziewoński):
Convert mediawiki.action.edit.collapsibleFooter and mediawiki.special.changeslist.legend to using mw.cookie

https://gerrit.wikimedia.org/r/211409

matmarex reopened this task as Open.May 28 2015, 5:17 AM

Reverted, caused problems with csching hacks in wmf config.

Change 217015 had a related patch set uploaded (by Krinkle):
Convert mediawiki.toc and mediawiki.user to using mw.cookie

https://gerrit.wikimedia.org/r/217015

Change 217015 merged by jenkins-bot:
Convert mediawiki.toc and mediawiki.user to using mw.cookie

https://gerrit.wikimedia.org/r/217015

Change 211409 merged by jenkins-bot:
Convert mediawiki.action.edit.collapsibleFooter and mediawiki.special.changeslist.legend to using mw.cookie

https://gerrit.wikimedia.org/r/211409

TheDJ added a subscriber: TheDJ.Jun 11 2015, 6:35 AM

Ehm, wasn't ops supposed to sign off any further cookie patches ?

matmarex renamed this task from Use mediawiki.cookie instead of jquery.cookie to Use mediawiki.cookie instead of jquery.cookie in MediaWiki-specific scripts.Oct 27 2015, 9:41 PM
matmarex removed a project: Patch-For-Review.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 27 2015, 9:41 PM
matmarex closed this task as Resolved.Oct 27 2015, 9:42 PM
matmarex claimed this task.

The last two patches fixed this. Seems that the sky has not fallen on our heads this time, thankfully.