Change Details

Currently the ReauthenticateTime is 60 seconds (1 minute) for 2FA operations and 300 seconds (5 minutes) for other operations in MW core. We want to increase both to 3600 seconds (1 hour). This means changing the default in MW core and dropping the oath-specific override in OATHAuth. After that, we want to put all of Special:OATHManage behind a reauth. Right now it just does a reauth when adding a method (and that's broken because it exempts POST requests, so it's easy to bypass). Instead we should require reauth for any action or even viewing that special page at all (so just one unconditional check when rendering that special page). The code for this will have a depends-on for the previous code.

Currently the time a reauhentication is valid for (ReauthenticateTime) is 60 seconds (1 minute) for 2FA operations (set in OATHAuth) and 300 seconds (5 minutes) for other operations in MW core (like changing one's password). We want to increase both to 3600 seconds (1 hour). This means changing the default in MW core and dropping the oath-specific override in OATHAuth.

Currently the time a reauhentication is valid for (ReauthenticateTime) is 60 seconds (1 minute) for 2FA operations (set in OATHAuth) and 300 seconds (5 minutes) for other operations in MW core (like changing one's password). We want to increase both to 3600 seconds (1 hour). This means changing the default in MW core and dropping the oath-specific override in OATHAuth. After that, we want to put all of Special:OATHManage behind a reauth. Right now it just does a reauth when adding a method (and that's broken because it exempts POST requests, so it's easy to bypass). Instead we should require reauth for any action or even viewing that special page at all (so just one unconditional check when rendering that special page). The code for this will have a depends-on for the previous code.