element-hq / element-hq/dendrite

When registering using the User-Interactive Authentication API and without providing a username, the numeric user id generated by dendrite is rejected as reserved

Open
#3,129 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
965
Forks
101
PR merge metrics
No merged PRs in 30d

Description

*This issue was originally created by [**@CicadaCinema**](https://github.com/CicadaCinema) at .*

### Background information

- **Dendrite version or git SHA**: v0.13.0
- **SQLite3 or Postgres?**: Postgres
- **Running in Docker?**: No
- **`go version`**: go1.18.1 linux/arm64
- **Client used (if applicable)**: N/A

### Description

https://github.com/matrix-org/dendrite/pull/470 introduced a feature to automatically generate a user id when the user does not provide a username. But when following the User-Interactive Authentication API flow, this is generated in the first request to `/register` (the one with no `auth` parameter). So when the client hits `/register` again, the previously-generated numeric id is rejected as being reserved.

Affected users are those which do not provide an `auth` parameter on the first call to `/register`, as well as not providing a username.

### Steps to reproduce

```python
>>> initial_resp = requests.post(url+"/_matrix/client/v3/register", json={"password": ""})
>>> initial_resp.status_code
401
>>> initial_resp.text
'{"flows":[{"stages":["m.login.dummy"]}],"completed":[],"params":{},"session":""}'
>>> subsequent_resp = requests.post(url+"/_matrix/client/v3/register", json={"password": "", "auth":{"session":"", "type": "m.login.dummy"}})
>>> subsequent_resp.status_code
400
>>> subsequent_resp.text
'{"errcode":"M_INVALID_USERNAME","error":"Numeric user IDs are reserved"}'
```

### Non-reproduction

Clients providing an `auth` parameter can complete registration in one request and are unaffected:
```python
>>> resp = requests.post(url+"/_matrix/client/v3/register", json={"password": "", "auth":{"type":"m.login.dummy"}})
>>> resp.status_code
200
>>> resp.text
'{"user_id":"@3:","access_token":"","device_id":""}'
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.