wiki_ra wrote:

... actually both '*.toolserver.org' and 'toolserver.org' would need to be added to the array since not all tools run on a subdomain.

This would allow *.toolserver.org to bypass CSRF checks, with escalation to full account compromise, say by editing the user's *.js subpages. I thought the whole point of using a separate 2nd level domain was to avoid cookie sharing with *.wikimedia.org. I assume toolserver.org is full of exploitable XSS vulnerabilities which could be used as a proxy to launch an attack against a Wikimedia user account from an external malicious site. I bet I could find one in 5 minutes.

Suggest WONTFIX.

wiki_ra wrote:

That's disappointing.

An possible alternative would be to change how the Access-Control-Allow-Credentials header is sent in api.php.

In CORS the Access-Control-Allow-Origin header allows cross-domain scripting, but the Access-Control-Allow-Credentials allows those scripts to share credentials and cookies. Setting Access-Control-Allow-Credentials to false (as opposed to true, which it is now) would allow JavaScript on the external server to connect to the API but not have access to cookies (i.e. could not log in).

Based on the [En.Wikipedia] Village Pump discussion[1], this is so java-script can use the users authentication to do editing and such? I thought the ToolServer already had rules against tools and such asking for/using a users authentication access on a WMF wiki[2] which is this not what the change would allow?

As pointed out by Tim, what other security issues would this bring up.... Because there are alot of tools on the toolserver and not sure all of them would be security checked/reviewed to ensure there are no issues on that front.

[1]. http://en.wikipedia.org/wiki/Wikipedia:Village_pump_%28proposals%29#Re-enabling_JavaScript_access_to_the_API
[2]. https://wiki.toolserver.org/view/Rules#Terms_of_Use (Point 8)

(In reply to comment #4)

As pointed out by Tim, what other security issues would this bring up....
Because there are alot of tools on the toolserver and not sure all of them
would be security checked/reviewed to ensure there are no issues on that front.

Exactly. Since almost anyone can get a toolserver account and host almost anything (even if it's against the rules, it'll take some time for toolserver admins to notice and take it off), toolserver.org is not fundamentally different from other non-WMF domains and should therefore be subject to the same security measures.