Change Details

See {T402597} for context. See {T384232} for more info on the checklist. == Login == [] basic password login [] logout [] "keep me logged in checkbox" (should result in `centralauth_Token` cookie with 1-year expiry on the wiki where you are logging in) [] title-blacklisted user cannot autocreate-on-login (test both the JS dropdown on the username field, and the form submit) [] LoginNotify email is sent after failed login attempts [] checkuser data is logged after successful login, including client hints === Reauthentication === [] when using Special:BotPassword, user is required to reauthenticate, then can set up a bot password (note that reauthentication timout has been increased to 1 hour recently - if you don't want to wait 1 hour after login, you can delete your `<wiki>Session` cookie to get a non-reauthenticated session) [] same for Special:ChangePassword (which will redirect to the central domain) === API === [] login via action=clientlogin (on a local domain) [] bot login via action=login [] log in and out on one of the WMF mobile apps === Credentials change === [] Change your password [] Do a password reset (log in with a temporary password) === Instrumentation === [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/account_conversion/current.yaml|accountcreation/account_conversion]] gets logged during successful login (see [[https://wikitech.wikimedia.org/wiki/Event_Platform/Instrumentation_How_To#EventStreams|EventStreams docs]]) == Central session == [] after login or signup, user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in user should autologin when clicking login link [] after temp user creation, temp user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in temp user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in temp user should autologin when clicking login link [] logout clears the `centralauth_*` cookies on registrable domains other than the current one == Signup == [] basic user account creation [] email notification gets sent, links use canonical domain [] incorrect captcha prevents signup [] title-blacklisted user cannot signup, gets reasonable error message (test both the JS validator on the username field, and the form submit) [] singing up with [[https://en.wikipedia.org/wiki/IDN_homograph_attack|IDN homograph]] equivalent of existing username prevented by AntiSpoof (test both the JS dropdown on the username field, and the form submit) [] AbuseFilter can block account creation (you can make a test filter on testwiki with something like `action == "createaccount" & accountname == "MyTestAccount"`) (test both the JS validator on the username field, and the form submit) [] NewUserMessage welcome message (especially that it doesn't end up with auth.wikimedia.org URLs due to parser cache pollution) === API === [] sign up on one of the WMF mobile apps === Temp users === [] temp user creation via edit works in basic editor [] temp user creation via edit works in some JS editor, e.g. DiscussionTools [] temp user can use Special:CreateAccount to turn into a named user == OAuth == [] Create an owner-only OAuth app [] test (e.g. with action=query&meta=userinfo) an OAuth 1 request with an owner-only app [] test (e.g. with action=query&meta=userinfo) an OAuth 2 request with an owner-only app [] test an OAuth 1 request with a non-owner-only app (you can use [[https://oauth-hello-world.toolforge.org/|oauth-hello-world]]) [] do this while not being logged in on Wikipedia (you should be sent to login and then to the authorization dialog) [] test an OAuth 2 request with a non-owner-only app (you have to find/make an OAuth 2 tool, or maybe we should do {T384442} first) [] OAuth login flow: use OAuth-based identity while not being logged in on Wikimedia (the OAuth Authorization would have to happen on testwiki, not sure if there's an existing tool like that, or we need to create a new tool for testing) == 2FA == [] login with TOTP second factor (try wrong code, then correct code) [] login with WebAuthn second factor [] Add and remove a WebAuthn passkey [] Add and remove a TOTP passkey [] You get an EmailAuth challenge when logging in with `forceEmailAuth=1` cookie set on `auth.wikimedia.org`

See {T402597} for context. See {T384232} forhas more info on thsome checklistt items. == Login == [] basic password login [] logout [] "keep me logged in checkbox" (should result in `centralauth_Token` cookie with 1-year expiry on the wiki where you are logging in) [] title-blacklisted user cannot autocreate-on-login (test both the JS dropdown on the username field, and the form submit) [] LoginNotify email is sent after failed login attempts [] checkuser data is logged after successful login, including client hints === Reauthentication === [] when using Special:BotPassword, user is required to reauthenticate, then can set up a bot password (note that reauthentication timout has been increased to 1 hour recently - if you don't want to wait 1 hour after login, you can delete your `<wiki>Session` cookie to get a non-reauthenticated session) [] same for Special:ChangePassword (which will redirect to the central domain) === API === [] login via action=clientlogin (on a local domain) [] bot login via action=login [] log in and out on one of the WMF mobile apps === Credentials change === [] Change your password [] Do a password reset (log in with a temporary password) === Instrumentation === [] [[https://schema.wikimedia.org/repositories//secondary/jsonschema/analytics/mediawiki/accountcreation/account_conversion/current.yaml|accountcreation/account_conversion]] gets logged during successful login (see [[https://wikitech.wikimedia.org/wiki/Event_Platform/Instrumentation_How_To#EventStreams|EventStreams docs]]) == Central session == [] after login or signup, user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in user should autologin when clicking login link [] after temp user creation, temp user should be logged in on other registrable domains [] "keep me logged in" state is transferred correctly [] after deleting cookies on a given domain, centrally logged-in temp user should autologin [] after deleting cookies on a given domain and setting `CentralAuthAnon=1` cookie, centrally logged-in temp user should autologin when clicking login link [] logout clears the `centralauth_*` cookies on registrable domains other than the current one == Signup == [] basic user account creation [] email notification gets sent, links use canonical domain [] incorrect captcha prevents signup [] title-blacklisted user cannot signup, gets reasonable error message (test both the JS validator on the username field, and the form submit) [] singing up with [[https://en.wikipedia.org/wiki/IDN_homograph_attack|IDN homograph]] equivalent of existing username prevented by AntiSpoof (test both the JS dropdown on the username field, and the form submit) [] AbuseFilter can block account creation (you can make a test filter on testwiki with something like `action == "createaccount" & accountname == "MyTestAccount"`) (test both the JS validator on the username field, and the form submit) [] NewUserMessage welcome message (especially that it doesn't end up with auth.wikimedia.org URLs due to parser cache pollution) === API === [] sign up on one of the WMF mobile apps === Temp users === [] temp user creation via edit works in basic editor [] temp user creation via edit works in some JS editor, e.g. DiscussionTools [] temp user can use Special:CreateAccount to turn into a named user == OAuth == [] Create an owner-only OAuth app [] test (e.g. with action=query&meta=userinfo) an OAuth 1 request with an owner-only app [] test (e.g. with action=query&meta=userinfo) an OAuth 2 request with an owner-only app [] test an OAuth 1 request with a non-owner-only app (you can use [[https://oauth-hello-world.toolforge.org/|oauth-hello-world]]) [] do this while not being logged in on Wikipedia (you should be sent to login and then to the authorization dialog) [] test an OAuth 2 request with a non-owner-only app (you have to find/make an OAuth 2 tool, or maybe we should do {T384442} first) [] OAuth login flow: use OAuth-based identity while not being logged in on Wikimedia (the OAuth Authorization would have to happen on testwiki, not sure if there's an existing tool like that, or we need to create a new tool for testing) == 2FA == [] login with TOTP second factor (try wrong code, then correct code) [] login with WebAuthn second factor [] Add and remove a WebAuthn passkey [] Add and remove a TOTP passkey [] You get an EmailAuth challenge when logging in with `forceEmailAuth=1` cookie set on `auth.wikimedia.org` NOTE: Moved to subtasks.