Hi Ad, There are some security considerations if you're going to do that: * We disable site and user .js on Special:UserLogin, so a malicious admin can't add password sniffing javascript to the login page * We disable framing the page to prevent various redressing attacks * If your site is mixed http/https, there is special handling on that page to ensure the user enters/submits their password over https. * If you're using CentralAuth or another SSO system, then we check if you're logged in on Special:UserLogin, to work around some browser cookie policies. So it's *usually* not a good idea to create your own login widget. But if you're running your site entirely under https, have a limited number of admins, add XFO headers on all pages, and don't use any SSO system, then go for it! On Tuesday, September 29, 2015, Ad Strack van Schijndel < ad.strackvanschijndel(a)gmail.com&gt; wrote:

Is there a bug filed for that? On Sep 30, 2015 12:13, "Daniel Friesen" &lt;daniel(a)nadir-seen-fire.com&gt; wrote:

Can you provide any documentation on the details of this exploit? On Wed, Sep 30, 2015 at 12:50 PM, Daniel Friesen &lt;daniel(a)nadir-seen-fire.com > Bug? There is nothing that can be fixed. > > You just have to accept that as long as the login page is on the same > domain as site scripts, there is no way to stop those scripts from > controlling the login page. > > ~Daniel Friesen (Dantman, Nadir-Seen-Fire) [http://danielfriesen.name/] > > On 2015-09-30 9:33 AM, Tyler Romeo wrote: > > Is there a bug filed for that? > > On Sep 30, 2015 12:13, "Daniel Friesen" &lt;daniel(a)nadir-seen-fire.com&gt; > > > >> On 2015-09-30 8:48 AM, Chris Steipp wrote: > >>> * We disable site and user .js on Special:UserLogin, so a malicious > admin > >>> can't add password sniffing javascript to the login page > >> Note that you can make use of pushState to render this protection moot > >> for anyone who clicks the login link instead of directly visiting > >> UserLogin page. Which is practically everyone. > >> > >> ~Daniel Friesen (Dantman, Nadir-Seen-Fire) [http://danielfriesen.name/] > >> > >> > >> _______________________________________________ > >> MediaWiki-l mailing list > >> To unsubscribe, go to: > >> https://lists.wikimedia.org/mailman/listinfo/mediawiki-l > >> > > _______________________________________________ > > MediaWiki-l mailing list > > To unsubscribe, go to: > > https://lists.wikimedia.org/mailman/listinfo/mediawiki-l > > > _______________________________________________ > MediaWiki-l mailing list > To unsubscribe, go to: > https://lists.wikimedia.org/mailman/listinfo/mediawiki-l >

There is a slight difference in the ux if you're using pushState vs actually going to the page, so I think it would be noticed. But agree, I should probably have said "make it more difficult". On Wed, Sep 30, 2015 at 9:50 AM, Daniel Friesen &lt;daniel(a)nadir-seen-fire.com&gt; wrote:

Hi Chris, Thanks for your answer! One thing I don't understand is about the XFO headers. Do we have to add them or is it a condition that we don't have them. Ad Op 30 sep. 2015, om 17:48 heeft Chris Steipp &lt;csteipp(a)wikimedia.org&gt; het volgende geschreven: Hi Ad, There are some security considerations if you're going to do that: * We disable site and user .js on Special:UserLogin, so a malicious admin can't add password sniffing javascript to the login page * We disable framing the page to prevent various redressing attacks * If your site is mixed http/https, there is special handling on that page to ensure the user enters/submits their password over https. * If you're using CentralAuth or another SSO system, then we check if you're logged in on Special:UserLogin, to work around some browser cookie policies. So it's *usually* not a good idea to create your own login widget. But if you're running your site entirely under https, have a limited number of admins, add XFO headers on all pages, and don't use any SSO system, then go for it! On Tuesday, September 29, 2015, Ad Strack van Schijndel < ad.strackvanschijndel(a)gmail.com&gt; wrote: _______________________________________________ MediaWiki-l mailing list To unsubscribe, go to: https://lists.wikimedia.org/mailman/listinfo/mediawiki-l