Last modified: 2013-08-27 13:36:59 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T54079, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 52079 - remove token logging, or change to sessionId cookie
remove token logging, or change to sessionId cookie
Status: NEW
Product: MediaWiki extensions
Classification: Unclassified
Campaigns (Other open bugs)
master
All All
: Normal minor (vote)
: ---
Assigned To: spage
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-07-26 04:53 UTC by spage
Modified: 2013-08-27 13:36 UTC (History)
4 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description spage 2013-07-26 04:53:54 UTC
When Campaign logs a ServerSideAccountCreation event, it still logs the 'mediaWiki.user.id' cookie as the token field.

As https://meta.wikimedia.org/wiki/Schema_talk:ServerSideAccountCreation#event_token_changes says, client-side code no longer sets this long-lived cookie since bug 44327 was fixed in May 2013. Instead if mw.user.id() is called it sets a 'mediaWiki.user.sessionId' cookie.

Depending on need and privacy policy, Campaign could be changed to not log token, or to log the new 'mediaWiki.user.sessionId' cookie. FYI account creation does not currently set either cookie; the current callers of mw.user.id() are AFT, AFTv5, and UniversalLanguageSelector.

Many events still have a non-blank token (30% of all enwiki and dewiki account creations). Apparently people are creating accounts in browsers that set this cookie months ago.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links