Change Details

See {T402597} for context. See {384232} for more info on the checklist. == Login == [] basic password login [] "keep me logged in checkbox" (should result in `centralauth_Token` cookie with 1-year expiry on the wiki where you are logging in) [] forced password change on login when having a weak password [] login with a temporary password [] login with a temporary password, on a different wiki than where the email was sent from [] captcha appears after a few failed login attempts for the same user, and prevents further login attempts unless correctly filled out [] login gets throttled after even more failed attempts [] blocked user cannot login on private wiki, gets reasonable error message (🚧 would need access to a private wiki to test) [] title-blacklisted user cannot autocreate-on-login (test both the JS dropdown on the username field, and the form submit) [] user with name blocked by AbuseFilter cannot autocreate-on-login (test both the JS dropdown on the username field, and the form submit) [] user cannot autocreate-on-login on a closed wiki [] test one of the mitigations in PrivateSettings [] login with TOTP second factor (try wrong code, then correct code) [] WebAuthn second factor [] starting signup, switching to login via user menu [] when using Special:BotPassword, user is required to reauthenticate, then can set up a bot password (note that reauthentication timout has been increased to 1 hour recently - if you don't want to wait 1 hour after login, you can delete your `<wiki>Session` cookie to get a non-reauthenticated session [] same for Special:ChangePassword (which will redirect to the central domain) [] OAuth flow: use OAuth-based identity while not being logged in on Wikimedia (the OAuth Authorization would have to happen on testwiki, not sure if there's an existing tool like that, or we need to create a new tool for testing) [] login via a permission error redirect (e.g. visit Special:Preferences while logged out) [] NewUserMessage autocreate welcome message [] checkuser data is logged after successful login, including client hints [] checkuser data is logged after failed login login, including client hints [] LoginNotify email is sent after login from new device [] LoginNotify email is sent after failed login [] You get an EmailAuth challenge when logging in from a new IP (that's not very close to your old IP) and with no `loginnotify_prevlogins` cookie == Signup == [] basic user account creation [] email notification gets sent, links use canonical domain [] captcha works [] signup gets throttled after a few successful signups from the same IP; can be unthrottled with [[https://wikitech.wikimedia.org/wiki/Increasing_account_creation_threshold | resetAuthenticationThrottle]] [] blocked user cannot sign up, gets reasonable error message [] same for spam-blacklisted user (test both the JS dropdown on the username field, and the form submit) [] test one of the mitigations in PrivateSettings [] same for title-blacklisted user (test both the JS dropdown on the username field, and the form submit) [] same for username caught by AntiSpoof (test both the JS dropdown on the username field, and the form submit) [] same for username blocked by AbuseFilter (test both the JS dropdown on the username field, and the form submit) [] signup is disallowed on a closed wiki [] starting login, switching to signup via form button [] starting login, switching to signup via user menu [] GrowthExperiments signup flow (signup should end with Special:WelcomeSurvey) [] GrowthExperiments signup-during-edit flow (signup from VE should end with Special:WelcomeSurvey after page save) [] [[https://www.mediawiki.org/wiki/Extension:GrowthExperiments/Technical_documentation/Campaigns/Creation_of_customized_landing_pages|customized landing pages]] (especially that it doesn't result in auth.wikimedia.org URLs for some inolved page / message due to parser cache pollution) [] NewUserMessage welcome message (especially that it doesn't end up with auth.wikimedia.org URLs due to parser cache pollution) [] `campaign` URL parameter results in user preference correctly set [] `incubatortestwiki-project`/`incubatortestwiki-code` user preferences correctly set when using a signup link with `testwikiproject` / `testwikicode` query parameters on Incubator === Temp users === [] temp user creation via edit works in basic editor [] temp user creation via edit works in some JS editor, e.g. DiscussionTools [] temp user signing up for named account == Credentials change == [] Change your password [] Do a password reset [] Add and remove a WebAuthn passkey [] Create an owner-only OAuth == API == [] login via action=clientlogin (on a local domain) [] bot login via action=login [] action=logout [] test (e.g. with action=query&meta=userinfo) an OAuth 1 request with an owner-only provider [] test (e.g. with action=query&meta=userinfo) an OAuth 2 request with an owner-only provider [] test an OAuth 1 request with a non-owner-only provider (you can use [[https://oauth-hello-world.toolforge.org/|oauth-hello-world]]) [] test an OAuth 2 request with a non-owner-only provider (you have to find/make an OAuth 2 tool, or maybe we should do {T384442} first) == Central session == [] after login or signup, user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in user should autologin when clicking login link [] after temp user creation, temp user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in temp user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in temp user should autologin when clicking login link [] logout clears the `centralauth_*` cookies on registrable domains other than the current one == Instrumentation == [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/account_conversion/current.yaml|accountcreation/account_conversion]] gets logged during login page view + after successful login, and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories/secondary/jsonschema/analytics/legacy/serversideaccountcreation/current.yaml|serversideaccountcreation]] gets logged after signup and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/account_conversion/current.yaml|accountcreation/account_conversion]] gets logged during signup page view + after successful signup, and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/block/current.yaml|accountcreation/block]] gets logged after signup attempt from a blocked IP, and has correct SUL3 flag [] `sul3_authentication_start_total` / `sul3_authentication_end_total` gets incremented during login / signup

See {T402597} for context. See {384232} for more info on the checklist. == Login == [] basic password login [] "keep me logged in checkbox" (should result in `centralauth_Token` cookie with 1-year expiry on the wiki where you are logging in) [] forced password change on login when having a weak password [] login with a temporary password [] login with a temporary password, on a different wiki than where the email was sent from [] captcha appears after a few failed login attempts for the same user, and prevents further login attempts unless correctly filled out [] login gets throttled after even more failed attempts [] blocked user cannot login on private wiki, gets reasonable error message (🚧 would need access to a private wiki to test) [] title-blacklisted user cannot autocreate-on-login (test both the JS dropdown on the username field, and the form submit) [] user with name blocked by AbuseFilter cannot autocreate-on-login (test both the JS dropdown on the username field, and the form submit) [] user cannot autocreate-on-login on a closed wiki [] test one of the mitigations in PrivateSettings [] login with TOTP second factor (try wrong code, then correct code) [] WebAuthn second factor [] starting signup, switching to login via user menu [] when using Special:BotPassword, user is required to reauthenticate, then can set up a bot password (note that reauthentication timout has been increased to 1 hour recently - if you don't want to wait 1 hour after login, you can delete your `<wiki>Session` cookie to get a non-reauthenticated session [] same for Special:ChangePassword (which will redirect to the central domain) [] OAuth flow: use OAuth-based identity while not being logged in on Wikimedia (the OAuth Authorization would have to happen on testwiki, not sure if there's an existing tool like that, or we need to create a new tool for testing) [] login via a permission error redirect (e.g. visit Special:Preferences while logged out) [] NewUserMessage autocreate welcome message [] checkuser data is logged after successful login, including client hints [] checkuser data is logged after failed login login, including client hints [] LoginNotify email is sent after login from new device [] LoginNotify email is sent after failed login [] You get an EmailAuth challenge when logging in from a new IP (that's not very close to your old IP) and with no `loginnotify_prevlogins` cookie == Signup == [] basic user account creation [] email notification gets sent, links use canonical domain [] captcha works [] signup gets throttled after a few successful signups from the same IP; can be unthrottled with [[https://wikitech.wikimedia.org/wiki/Increasing_account_creation_threshold | resetAuthenticationThrottle]] [] blocked user cannot sign up, gets reasonable error message [] same for spam-blacklisted user (test both the JS dropdown on the username field, and the form submit) [] test one of the mitigations in PrivateSettings [] same for title-blacklisted user (test both the JS dropdown on the username field, and the form submit) [] same for username caught by AntiSpoof (test both the JS dropdown on the username field, and the form submit) [] same for username blocked by AbuseFilter (test both the JS dropdown on the username field, and the form submit) [] signup is disallowed on a closed wiki [] starting login, switching to signup via form button [] starting login, switching to signup via user menu [] GrowthExperiments signup flow (signup should end with Special:WelcomeSurvey) [] GrowthExperiments signup-during-edit flow (signup from VE should end with Special:WelcomeSurvey after page save) [] [[https://www.mediawiki.org/wiki/Extension:GrowthExperiments/Technical_documentation/Campaigns/Creation_of_customized_landing_pages|customized landing pages]] (especially that it doesn't result in auth.wikimedia.org URLs for some inolved page / message due to parser cache pollution) [] NewUserMessage welcome message (especially that it doesn't end up with auth.wikimedia.org URLs due to parser cache pollution) [] `campaign` URL parameter results in user preference correctly set [] `incubatortestwiki-project`/`incubatortestwiki-code` user preferences correctly set when using a signup link with `testwikiproject` / `testwikicode` query parameters on Incubator === Temp users === [] temp user creation via edit works in basic editor [] temp user creation via edit works in some JS editor, e.g. DiscussionTools [] temp user signing up for named account == Credentials change == [] Change your password [] Do a password reset [] Add and remove a WebAuthn passkey [] Create an owner-only OAuth == API == [] login via action=clientlogin (on a local domain) [] bot login via action=login [] action=logout [] log in and out on one of the WMF mobile apps [] test (e.g. with action=query&meta=userinfo) an OAuth 1 request with an owner-only provider [] test (e.g. with action=query&meta=userinfo) an OAuth 2 request with an owner-only provider [] test an OAuth 1 request with a non-owner-only provider (you can use [[https://oauth-hello-world.toolforge.org/|oauth-hello-world]]) [] test an OAuth 2 request with a non-owner-only provider (you have to find/make an OAuth 2 tool, or maybe we should do {T384442} first) == Central session == [] after login or signup, user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in user should autologin when clicking login link [] after temp user creation, temp user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in temp user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in temp user should autologin when clicking login link [] logout clears the `centralauth_*` cookies on registrable domains other than the current one == Instrumentation == [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/account_conversion/current.yaml|accountcreation/account_conversion]] gets logged during login page view + after successful login, and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories/secondary/jsonschema/analytics/legacy/serversideaccountcreation/current.yaml|serversideaccountcreation]] gets logged after signup and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/account_conversion/current.yaml|accountcreation/account_conversion]] gets logged during signup page view + after successful signup, and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/block/current.yaml|accountcreation/block]] gets logged after signup attempt from a blocked IP, and has correct SUL3 flag [] `sul3_authentication_start_total` / `sul3_authentication_end_total` gets incremented during login / signup

See {T402597} for context. See {384232} for more info on the checklist. == Login == [] basic password login [] "keep me logged in checkbox" (should result in `centralauth_Token` cookie with 1-year expiry on the wiki where you are logging in) [] forced password change on login when having a weak password [] login with a temporary password [] login with a temporary password, on a different wiki than where the email was sent from [] captcha appears after a few failed login attempts for the same user, and prevents further login attempts unless correctly filled out [] login gets throttled after even more failed attempts [] blocked user cannot login on private wiki, gets reasonable error message (🚧 would need access to a private wiki to test) [] title-blacklisted user cannot autocreate-on-login (test both the JS dropdown on the username field, and the form submit) [] user with name blocked by AbuseFilter cannot autocreate-on-login (test both the JS dropdown on the username field, and the form submit) [] user cannot autocreate-on-login on a closed wiki [] test one of the mitigations in PrivateSettings [] login with TOTP second factor (try wrong code, then correct code) [] WebAuthn second factor [] starting signup, switching to login via user menu [] when using Special:BotPassword, user is required to reauthenticate, then can set up a bot password (note that reauthentication timout has been increased to 1 hour recently - if you don't want to wait 1 hour after login, you can delete your `<wiki>Session` cookie to get a non-reauthenticated session [] same for Special:ChangePassword (which will redirect to the central domain) [] OAuth flow: use OAuth-based identity while not being logged in on Wikimedia (the OAuth Authorization would have to happen on testwiki, not sure if there's an existing tool like that, or we need to create a new tool for testing) [] login via a permission error redirect (e.g. visit Special:Preferences while logged out) [] NewUserMessage autocreate welcome message [] checkuser data is logged after successful login, including client hints [] checkuser data is logged after failed login login, including client hints [] LoginNotify email is sent after login from new device [] LoginNotify email is sent after failed login [] You get an EmailAuth challenge when logging in from a new IP (that's not very close to your old IP) and with no `loginnotify_prevlogins` cookie == Signup == [] basic user account creation [] email notification gets sent, links use canonical domain [] captcha works [] signup gets throttled after a few successful signups from the same IP; can be unthrottled with [[https://wikitech.wikimedia.org/wiki/Increasing_account_creation_threshold | resetAuthenticationThrottle]] [] blocked user cannot sign up, gets reasonable error message [] same for spam-blacklisted user (test both the JS dropdown on the username field, and the form submit) [] test one of the mitigations in PrivateSettings [] same for title-blacklisted user (test both the JS dropdown on the username field, and the form submit) [] same for username caught by AntiSpoof (test both the JS dropdown on the username field, and the form submit) [] same for username blocked by AbuseFilter (test both the JS dropdown on the username field, and the form submit) [] signup is disallowed on a closed wiki [] starting login, switching to signup via form button [] starting login, switching to signup via user menu [] GrowthExperiments signup flow (signup should end with Special:WelcomeSurvey) [] GrowthExperiments signup-during-edit flow (signup from VE should end with Special:WelcomeSurvey after page save) [] [[https://www.mediawiki.org/wiki/Extension:GrowthExperiments/Technical_documentation/Campaigns/Creation_of_customized_landing_pages|customized landing pages]] (especially that it doesn't result in auth.wikimedia.org URLs for some inolved page / message due to parser cache pollution) [] NewUserMessage welcome message (especially that it doesn't end up with auth.wikimedia.org URLs due to parser cache pollution) [] `campaign` URL parameter results in user preference correctly set [] `incubatortestwiki-project`/`incubatortestwiki-code` user preferences correctly set when using a signup link with `testwikiproject` / `testwikicode` query parameters on Incubator === Temp users === [] temp user creation via edit works in basic editor [] temp user creation via edit works in some JS editor, e.g. DiscussionTools [] temp user signing up for named account == Credentials change == [] Change your password [] Do a password reset [] Add and remove a WebAuthn passkey [] Create an owner-only OAuth == API == [] login via action=clientlogin (on a local domain) [] bot login via action=login [] action=logout [] log in and out on one of the WMF mobile apps [] test (e.g. with action=query&meta=userinfo) an OAuth 1 request with an owner-only provider [] test (e.g. with action=query&meta=userinfo) an OAuth 2 request with an owner-only provider [] test an OAuth 1 request with a non-owner-only provider (you can use [[https://oauth-hello-world.toolforge.org/|oauth-hello-world]]) [] test an OAuth 2 request with a non-owner-only provider (you have to find/make an OAuth 2 tool, or maybe we should do {T384442} first) == Central session == [] after login or signup, user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in user should autologin when clicking login link [] after temp user creation, temp user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in temp user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in temp user should autologin when clicking login link [] logout clears the `centralauth_*` cookies on registrable domains other than the current one == Instrumentation == [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/account_conversion/current.yaml|accountcreation/account_conversion]] gets logged during login page view + after successful login, and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories/secondary/jsonschema/analytics/legacy/serversideaccountcreation/current.yaml|serversideaccountcreation]] gets logged after signup and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/account_conversion/current.yaml|accountcreation/account_conversion]] gets logged during signup page view + after successful signup, and has correct SUL3 flag [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/block/current.yaml|accountcreation/block]] gets logged after signup attempt from a blocked IP, and has correct SUL3 flag [] `sul3_authentication_start_total` / `sul3_authentication_end_total` gets incremented during login / signup