[horsawlarway]

My strong suspicion is that the blocking is done at a different layer.

Much easier to simply block posts/puts to certain paths from ip ranges in the ingress layer, before they ever reach the application and are authenticated.

[kemayo]

Nah, the blocks happen inside mediawiki. There's nothing technically stopping it from exempting logged in users, just a policy choice.

Basically: https://www.mediawiki.org/wiki/Help:Range_blocks