Change Details

When calling a REST endpoint and supplying an OAuth2 access token, if the access token is invalid, the caller receives a "403 Permission Denied" with details of "rest-read-denied". This can be reproduced by executing: > curl -v -H "Content-Type: application/json" -H "authorization: Bearer this-is-aninvalid-token" https://en.wikipedia.beta.wmflabs.org/w/rest.php/coredev/v0/page/Barack_Obama This occurs regardless of the wiki's configuration settings, and no possible configuration settings will fix this. This is unhelpful, because it does not point the caller to the actual cause of the error (invalid access token), and instead implies that permissions are at fault. What actually happens in that the MWOAuthSessionProvider plumbing, in this case, creates an anonymous user with absolutely no rights, not even the rights normally associated with the anonymous user. The REST API endpoints then check for the “read” right via isReadAllowed, and that check fails. https://gerrit.wikimedia.org/g/mediawiki/core/+/7ac4ec51cc0608366b4873bf892770af4d6b7f20/includes/Rest/BasicAccess/BasicRequestAuthorizer.php#34 The mediawiki debug log contains “MediaWiki\Extensions\OAuth\MWOAuthSessionProvider::getAllowedUserRights: No provider metadata, returning no rights allowed”. This is slightly less unhelpful, but not much. More helpful would be to return an error indicating that the access token was invalid.

When calling a REST endpoint and supplying an OAuth2 access token, if the access token is invalid, the caller receives a "403 Permission Denied" with details of "rest-read-denied". This can be reproduced by executing: > curl -i -H "Content-Type: application/json" -H "authorization: Bearer this-is-aninvalid-token" https://en.wikipedia.beta.wmflabs.org/w/rest.php/v1/page/Barack_Obama/html ``` HTTP/2 403 ... {"error":"rest-read-denied","httpCode":403,"httpReason":"Forbidden"} ``` This occurs regardless of the wiki's configuration settings, and no possible configuration settings will fix this. This is unhelpful, because it does not point the caller to the actual cause of the error (invalid access token), and instead implies that permissions are at fault. What actually happens in that the MWOAuthSessionProvider plumbing, in this case, creates an anonymous user with absolutely no rights, not even the rights normally associated with the anonymous user. The REST API endpoints then check for the “read” right via isReadAllowed, and that check fails. https://gerrit.wikimedia.org/g/mediawiki/core/+/7ac4ec51cc0608366b4873bf892770af4d6b7f20/includes/Rest/BasicAccess/BasicRequestAuthorizer.php#34 The mediawiki debug log contains “MediaWiki\Extensions\OAuth\MWOAuthSessionProvider::getAllowedUserRights: No provider metadata, returning no rights allowed”. This is slightly less unhelpful, but not much. More helpful would be to return an error indicating that the access token was invalid.

When calling a REST endpoint and supplying an OAuth2 access token, if the access token is invalid, the caller receives a "403 Permission Denied" with details of "rest-read-denied". This can be reproduced by executing: > curl -vi -H "Content-Type: application/json" -H "authorization: Bearer this-is-aninvalid-token" https://en.wikipedia.beta.wmflabs.org/w/rest.php/coredev/v0v1/page/Barack_Obamaama/html ``` HTTP/2 403 ... {"error":"rest-read-denied","httpCode":403,"httpReason":"Forbidden"} ``` This occurs regardless of the wiki's configuration settings, and no possible configuration settings will fix this. This is unhelpful, because it does not point the caller to the actual cause of the error (invalid access token), and instead implies that permissions are at fault. What actually happens in that the MWOAuthSessionProvider plumbing, in this case, creates an anonymous user with absolutely no rights, not even the rights normally associated with the anonymous user. The REST API endpoints then check for the “read” right via isReadAllowed, and that check fails. https://gerrit.wikimedia.org/g/mediawiki/core/+/7ac4ec51cc0608366b4873bf892770af4d6b7f20/includes/Rest/BasicAccess/BasicRequestAuthorizer.php#34 The mediawiki debug log contains “MediaWiki\Extensions\OAuth\MWOAuthSessionProvider::getAllowedUserRights: No provider metadata, returning no rights allowed”. This is slightly less unhelpful, but not much. More helpful would be to return an error indicating that the access token was invalid.