Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Inconsistenly using pre-stored params for UI auth #8968

Open
clokep opened this issue Dec 17, 2020 · 0 comments
Open

Inconsistenly using pre-stored params for UI auth #8968

clokep opened this issue Dec 17, 2020 · 0 comments
Labels
z-auth (Deprecated Label) z-bug (Deprecated Label) z-p3 (Deprecated Label)

Comments

@clokep
Copy link
Member

clokep commented Dec 17, 2020

We have two methods from the handler that get called on each request to complete UI auth, the aptly named validate_user_via_ui_auth and a lower-level method: check_ui_auth.

All endpoints call validate_user_via_ui_auth (which calls check_ui_auth under the hood) except those that don't yet have an known requester (register and password reset) which directly call check_ui_auth.

Per matrix-org/matrix-doc#2907, the parameters of the original request to UI auth get persisted and only need to be provided once to Synapse. Unfortunately it seems that most of the endpoints which call validate_user_via_ui_auth completely disregard this and ignore the return values, using only the parameters from the most recent request.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
z-auth (Deprecated Label) z-bug (Deprecated Label) z-p3 (Deprecated Label)
Projects
None yet
Development

No branches or pull requests

1 participant