OAuth consumers are able to set IP restrictions, for example consumer 571d07e4e3a8209ee5e83f603e8c4f61 has the WMF IPs {"IPAddresses":["208.80.152.0/22","198.35.26.0/23","10.0.0.0/8"]} as usage restriction.
These IP restrictions only seem to work when negotiating a new client token over Special:OAuth/initiate. When I locally make an API request with an already existing client/access token I get a valid response and no error.
I stumbled upon this due to the tools outage.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | None | T108064 MediaWiki Security release 1.25.3 | |||
| Resolved | • csteipp | T103022 OAuth IP restrictions only apply to Special:OAuth/initiate, not to general API requests |
Confirmed
@Anomie, I think that will cover the API calls and the call to /identify, but it would be great if you could sanity check it.
Looks sane, and I confirm that it looks like both the API code path and /identify call verify_request(). This also seems like the sensible place to put the check.
Haven't tested though.
@Sitic, do you have a local OAuth instance that you can test this patch and verify that it fixes the issue?
Tested locally, fixes the issue (getting The authorization headers in your request are not valid: <bad-source-ip> error now).