Page MenuHomePhabricator

mw.user.tokens does not include all token types
Closed, DeclinedPublic

Description

mw.user.getToken only supports edit, watch and patrol.
It should support all other types of token.


Version: 1.23.0
Severity: enhancement

Details

Reference
bz59148

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 2:38 AM
bzimport set Reference to bz59148.
bzimport added a subscriber: Unknown Object (MLST).

???

I can't find mw.user.getToken. mw.api.getToken exists and it supports all tokens.

Krinkle subscribed.

The user.tokens module is an internal optimisation to avoid one extra API roundtrip for built-in ajax actions such as "Ajax watchstar" and submitting edits to the API for e.g. VisualEditor and such.

The tokens should be retrieved via mw.Api#getToken which already supports all other token types. There are no plans to expand the set of preloaded token types as there is no performance reason to do so (yet).

Note that since 2014, most token types (such as move, edit, delete etc.) have been deprecated in favour of a single csrf token type, which should already significantly reduce the number of cases where mw.Api#getToken would actually need to fetch a token.