Page MenuHomePhabricator

mw.user.getToken does not support cross domain tokens
Closed, DeclinedPublic

Description

Using a centralauth token it is possible to get a token that is valid on another wiki. This is useful for instance when uploading from English Wikipedia to Wikimedia Commons (MobileFrontend does this)

mw.user.getToken does not support this use case however.


Version: 1.23.0
Severity: enhancement

Details

Reference
bz59149

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 2:38 AM
bzimport set Reference to bz59149.
bzimport added a subscriber: Unknown Object (MLST).
DannyS712 subscribed.

This is because the user edit tokens are included in the html response based on the local wiki, and it would be impossible to include the tokens for another domain because there is no access to that User object and you also don't know what other wiki the front-end user will want to make their request to. The solution is to make an api request to get that token (via action=query&meta=tokens) (or CentralAuth's version of mw.ForeignApi will handle it for you automatically in some cases)