We have two end-points in production:

1. https://en.wikipedia.org/api/rest_v1/#!/Recommendation/get_data_recommendation_article_creation_translation_from_lang_seed_article
2. https://en.wikipedia.org/api/rest_v1/#!/Recommendation/get_data_recommendation_article_creation_morelike_seed_article

The first one works with any language pair, but the second works for languages that have pre-generated data. The second API generates better results and is what we'll be improving in the future.

Would either one work for you? We could support more languages for the 2nd case if you let us know of language pairs you're interested in.

Have recommendation api to be included in the whitelist (need to determine how)

The content translation extension can call $this->getOutput()->getCSP()->addDefaultSrc( 'reccomend.wmflabs.org' ). However production services relying on labs stuff is in theory not allowed i think.

In T208197#5070227, @bmansurov wrote:

We have two end-points in production:

1. https://en.wikipedia.org/api/rest_v1/#!/Recommendation/get_data_recommendation_article_creation_translation_from_lang_seed_article
2. https://en.wikipedia.org/api/rest_v1/#!/Recommendation/get_data_recommendation_article_creation_morelike_seed_article

The first one works with any language pair, but the second works for languages that have pre-generated data. The second API generates better results and is what we'll be improving in the future.

Would either one work for you? We could support more languages for the 2nd case if you let us know of language pairs you're interested in.

en.wikipedia.org will of course be in the CSP whitelist, so CSP won't interfere with these.

Content Translation uses the recommendation API to surface opportunities for users to translate, which has been useful for users especially as they become closer to their interests.

My understanding is that the labs instance is used because the production does not provide feature parity. In particular, the production version is missing support for multiple "seed articles". Content translation uses those to get recommendations that are similar to the articles the user edited previously.

We were waiting for the production service to support this before migrating, but that has not happened so far. Migrating now means to either serve users with less diverse suggestions or refactor the code to add a workaround for the limitation of having only one seed article.

We have plans to replace the translation dashboard (T243583) where recommendations are provided, and that will include using the production recommendation system. I'd like to understand whether it is worth to fix this on the current dashboard before it is replaced. Does anyone have an estimate of when the cross-site access will be blocked?

@Reedy - How close are we to actually enforcing CSP on production wikis? Is there a place we can review all the wmflabs.org endpoints that are still being called from production (maybe even ranked by how frequently they are being called)?

In T208197#6134422, @kaldari wrote:

@Reedy - How close are we to actually enforcing CSP on production wikis? Is there a place we can review all the wmflabs.org endpoints that are still being called from production (maybe even ranked by how frequently they are being called)?

I'm not sure how far away we are; there's definitely still stuff to be done before it's enforcing everywhere.

All CSP events are logged to logstash. I don't think anyone has created any sort of CSP dashboard just yet though

See ContentSecurityPolicy and T239077 (among other tasks)

@Nikerabbit - I'm not seeing the "[Report Only] Refused to connect..." warnings when loading suggestions in ContentTranslation. Are you still seeing the warnings? FWIW, I'm not seeing the warnings anywhere anymore. Perhaps someone turned them off.

In T208197#6134679, @Reedy wrote:

In T208197#6134422, @kaldari wrote:

Is there a place we can review all the wmflabs.org endpoints that are still being called from production? […]

All CSP events are logged to logstash.

There is a Logstash dasboard, however this naturally includes all the opted-in activity, as well as activity by browser plugins. Afaik this dashboard mainly exists for investigation during potential malicious activity.

In general there are no violations of it on default traffic by user scripts, apart from the recent one for Wikivoyage's community script (T244691). And of course the current ticket about CX for prod, which I guess people had forgotten about.

There are from time to time small wikis uncovered to still run old versions of scripts, which are updated or disabled whenever they become known. See also T239077#6135626.

In T208197#6135027, @kaldari wrote:

[…] I'm not seeing the warnings anywhere anymore. Perhaps someone turned them off.

It was reported and re-confirmed a few days ago at T244952, which led to this.

Change 597531 had a related patch set uploaded (by Santhosh; owner: Santhosh):
[mediawiki/extensions/ContentTranslation@master] Use REST Apis for suggesting articles from recommendation system

https://gerrit.wikimedia.org/r/597531

Change 597531 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@master] Use REST Apis for suggesting articles from recommendation system

https://gerrit.wikimedia.org/r/597531