Uploading images sometimes will give invalid csrf token (some cookies are misusing the recommended "SameSite" attribute)

[nurmagoz]

When this happen i need to refresh Firefox and then i can upload back images.

[Patrick]

As for the missing SameSite attribute value / as for the yellow background text:

Most likely upstream issue.

⚓ T325663 Audit use of cookies #2

In short: MediaWiki I guess uses different code paths for creating cookies. That’s why some cookies are missing that setting.

I don’t think this warning causing the invalid CSRF token issue.

---

might be caused by this:

MediaWiki Cookie / https / onion settings

A few settings have been hardened for better security… https website version and onion website version: Now using HttpOnly. HttpOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it). Manual:$wgCookieHttpOnly - MediaWiki $wgCookieHttpOnly = true; https website version and onion website version: Now using SameSite …

---

---

Does this sounds like the issue…?

MediaWiki Cookie / https / onion settings

This has the disadvantage when following a link from a different domain name (such as from a search engine to whonix.org or from kicksecure.com to whonix.org) that the user appears to be logged out. Even in case the user is already logged in. When going to the URL bar and pressing enter, the user will appear logged-in. (Of course only if the user was previously logged in.) This is not a bug. This is to be expected when setting cookies to SameSite=Strict as per browser defaults. While not a bu…

[nurmagoz]

maybe and maybe the upload extension itself causing the issue as per:

Also it seems like extensions can set their own cookies but they’re not using a MediaWiki’s core API for that. Maybe MediaWiki’s extensions should be encouraged to use (a maybe yet to be invented) API to set cookies and MediaWiki’s core should add a warning encouraging extensions to use that API?

So, if there is a way to check if the extension is adhering to the same wiki configurations, that would be nice. Additionally, a newer version of the extension might be able to fix the issue.