>>! In T84960#950866, @Anomie wrote:
> The point isn't to make the tokens last **longer** than the session. [...] You won't get a 5-minute token and be able to extend it indefinitely by re-requesting it, or get a 5-minute token but then requesting it again after 4 minutes gives you the same token that will expire in only 1 minute, or [..]

I understand that. My point is that it seems useless to embed tokens in the html that client-side JavaScript (from core, extensions or gadgets) cannot reliably use because by design it will always expire after a few minutes. Similarly it seems useless that VisualEditor and other uses of tokens almost always have to make two or three round trips just to make a write action. Right now its three. 1) Failed write action for token expired, 2) get new token, 3) Re-try write again. Now only does it make two more http requests then desired, it also submits a potentially large amount of data multiple times.

Two facts:

* In the past we made the decision to embed the user.tokens module in the page because we saw performance problems with the client-side having to request a token for write actions by JavaScript (for e.g. watch star click, or VE edit save).
* In the past we made the observation that saving content with VisualEditor is a performance bottle neck, that we worked hard to cut down. Due to this token expiration problem, we basically nulled that effort by now having to submit everything twice.

As such, I would recommend strongly that we figure out a feasible way to allow MediaWiki frontend to perform write actions with the API without needing to fetch a separate token over HTTP. From this perspective, this change was a significant regression as both of these two expectations are no longer met by the system.

The naive approach of not making the tokens change every request is understandably not acceptable from a security perspective because of "BREACH"-type reflection attacks. The only option I see right now would be to continue issuing new tokens each page view but having those tokens (that are embedded in the page) be valid for the entire duration of a page view (or otherwise, at least an hour or so).