element-hq / element-hq/element-meta

Element X: in-app password change for password-auth homeservers (iOS first; Android on request)

Open
#3,176 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
112
Forks
25
Avg merge
6h 6m
Merged PRs (30d)
4

Description

# Feature request: Element X in-app password change for password-auth homeservers (iOS first)

## Problem
Element X currently supports password-based login for non-OIDC homeservers, but users cannot change their own password from mobile app settings. For self-hosted Synapse deployments that intentionally use manual account provisioning (admin-assigned initial passwords), this creates a practical security gap in day-to-day operations.

## Why this matters
- Home/family/community servers often do not run OIDC today.
- Admin sets initial password; user should immediately rotate it in-app.
- Requiring web/desktop for this one task is friction and causes delayed password rotation.

## Proposal
Add a minimal in-app "Change password" flow for password-auth accounts.

### Scope (v1)
- Single feature only: user changes own password.
- Use Matrix `/_matrix/client/v3/account/password` (UIA).
- No broader admin user-management scope.

### Delivery approach
- We can implement and contribute **iOS first**.
- If maintainers want parity in same effort, we are willing to follow with Android.

## Acceptance criteria
- Password-auth account can change password in app settings.
- Old password stops working; new password works.
- Optional existing Matrix behavior: "logout other sessions" if supported by flow.
- Feature hidden/disabled when auth type is OIDC-only or unsupported by homeserver.

## Context
There was a prior iOS issue closed as not planned:
- https://github.com/element-hq/element-x-ios/issues/3492

This request asks to re-evaluate based on current self-hosted operational reality where password auth login is already supported by Element X.

Contributor guide

No contributing guide indexed for this repository

Research direction

No implementation files or tests are identified in this meta issue. Start by reviewing the prior iOS issue #3492 and the Matrix v3 account/password UIA endpoint, then locate the current iOS settings and password-auth entry points. Done means password-auth users can change passwords, old credentials stop working, and the feature is unavailable for unsupported or OIDC-only homeservers.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios
Domain
authentication, mobile-dev
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.