Page MenuHomePhabricator

Remove cookie settings from mw.config
Closed, ResolvedPublic

Description

Currently, on all responses mw.config includes configuration variables wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration. These are documented[1] as being

@internal For mediawiki.cookie

However, since rMWa0370fe3c958: mediawiki.cookie: Export config via packageFiles by @Krinkle, mediawiki.cookie doesn't use mw.config to retrieve these settings, but rather they are injected via packageFiles. Thus, they should no longer be needed in mw.config.

Per codesearch, there are no uses in deployed javascript: https://codesearch.wmcloud.org/deployed/?q=wgCookie(Prefix|Domain|Path|Expiration)&i=nope&files=\.js$&excludeFiles=&repos=

However, a number of non-deployed extensions still use these, so an entry in the release notes is probably a good idea: https://codesearch.wmcloud.org/search/?q=wgCookie(Prefix|Domain|Path|Expiration)&i=nope&files=\.js$&excludeFiles=&repos=

[1] https://gerrit.wikimedia.org/g/mediawiki/core/ /3ff9183d2453413e7c8c550232918d11cfd1eb1b/includes/resourceloader/ResourceLoader.php#1979

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change 724381 had a related patch set uploaded (by DannyS712; author: DannyS712):

[mediawiki/core@master] Remove cookie settings from mw.config

https://gerrit.wikimedia.org/r/724381

Used by some onwiki scripts that should be fixed (notably sitewide scripts on mwlwiki, nlwikimedia, ptwiki)

@DannyS712 Hi. Re: Tech News - What would you suggest as the content, and When should it be included?
(I'm currently editing the edition that is due to be frozen-for-translations tomorrow (~25hours from now), and to be delivered on Monday). Thanks!

@DannyS712 Hi. Re: Tech News - What would you suggest as the content, and When should it be included?
(I'm currently editing the edition that is due to be frozen-for-translations tomorrow (~25hours from now), and to be delivered on Monday). Thanks!

Lets wait until at least next week. As for content, something also the lines of

The JavaScript mw.config no longer contains the values for wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration. These had previously be documented as for internal use and were not part of the "stable" variables available for use in wiki JavaScript.

@DannyS712 Hi. Re: Tech News - What would you suggest as the content, and When should it be included?
(I'm currently editing the edition that is due to be frozen-for-translations tomorrow (~25hours from now), and to be delivered on Monday). Thanks!

Lets wait until at least next week. As for content, something also the lines of

The JavaScript mw.config no longer contains the values for wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration. These had previously be documented as for internal use and were not part of the "stable" variables available for use in wiki JavaScript.

Actually, you can probably announce now that they will be removed soon

The JavaScript mw.config will soon no longer contain the values for wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration. These are currently documented as for internal use and are not part of the "stable" variables available for use in wiki JavaScript.

I think we can leave out the internal reason. The "internal" description may sound unfair because using these was previously the only way to store cookies in a wgCookie-compliant way. Instead, perhaps we can mention what the modern replacement is. Something like:

The JavaScript variables wgCookiePrefix, wgCookieDomain, wgCookiePath, and wgCookieExpiration will soon be removed from mw.config. Scripts should instead use mw.cookie from the "mediawiki.cookie" module. (Documentation, T291760)

Change 724381 merged by jenkins-bot:

[mediawiki/core@master] Remove cookie settings from mw.config

https://gerrit.wikimedia.org/r/724381