Document the CSRF token body parameter in TokenAwareHandlerTrait, and ReadingListsTokenAwareHandlerTrait in the ReadingLists extension, using a descriptive, translatable system message. Since OpenAPI 3.0 does not allow request body payloads, such as CSRF tokens, to be defined in the global securitySchemes object, we must document this conditional constraint inline on the parameters themselves.
The description should express that CSRF is conditional. CSRF is required for Cookie-based sessions, but not for OAuth because OAuth is CSRF-safe.
Conditions of Acceptance
- Added Handler::PARAM_DESCRIPTION for new message to getTokenParamDefinition() inside TokenAwareHandlerTrait.php. Reference: https://docs.google.com/document/d/1fQvy_Y7AIW4H-aa3HbDVqJK0Yz9ONVZynLbLcjQNKN8/edit?tab=t.0#heading=h.dg36qgytl2um
- Made an equivalent update for ReadingLists.
- Made the necessary edits in en.json and qqq.json for the message to be able to be translated.
References
- Parent task: T422484: [5.2.5b Epic] Add security mechanism information to the MediaWiki REST API description.
- To do after T427481: Extend MediaWiki Session framework to support OpenAPI metadata.
View of This Task in Context of Related Tasks
