element-hq / element-hq/element-web

Element relies on being able to one-shot user-interactive authentication for password changes

Open
#33,179 0 comments 0 reactions 0 assignees View on GitHub
A-Authentication A-Password-Reset O-Uncommon S-Major T-Defect Z-Spec-Compliance
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

1. Sign in to your account
2. Navigate to account settings to change your password
3. Put your existing password and desired new password in, and hit "Change Password"
4. Element makes a single request to `POST /_matrix/client/v3/account/password` containing authentication data and the requested reset data
5. Element fails and shows an error to the user when the endpoint returns a user-interactive authentication challenge response

### Outcome

#### What did you expect?
Per [the spec](https://spec.matrix.org/v1.18/client-server-api/#user-interactive-authentication-api), Element should first send a request without authentication data to create a session, and then send a followup request with the authentication data for the session requested by the homeserver (as is done for registration, deactivation, and logging out other devices). For example:

```
POST /_matrix/client/v3/account/password HTTP/1.1
{"new_password": "..."}

HTTP/1.1 401 Unauthorized
{"auth": {"session": "foobar"}}

POST /_matrix/client/v3/account/password HTTP/1.1
{"auth": {"session": "foobar", "password": "currentPassword", "identifier": {"...":"..."}}, "new_password": "..."}
```

#### What happened instead?
Element sends all of the data in the same request, without a session, which some homeservers may reject and instead create a new UIA session, responding with the challenge. In this case, my homeserver does not support sessionless authentication (i.e. if the client does not provide a session, a new one is created, and the challenge is served immediately). Then, rather than re-sending the provided data in response to the challenge, Element shows a modal to the user with the less than helpful message "MatrixError: [401] Unknown message (http://.../_matrix/client/v3/account/password) (HTTP status 401)":

```
POST /_matrix/client/v3/account/password HTTP/1.1
{
"auth": {
"type": "m.login.password",
"identifier": {
"type": "m.id.user",
"user": "@test:localhost:8008"
},
"password": "D2b0a3006de42109931e5696@"
},
"new_password": "d2b0a3006de42109931e5696",
"logout_devices": false
}

HTTP/1.1 401 Unauthorized
{"completed":[],"errcode":"","error":"","flows":[{"stages":["m.login.password"]}],"session":"2YCzhYMiGJhlfOLQ"}
```
Then the following error:
![screenshot of error modal, with surrounding context, including the request body](https://files.i-am.nexus/u/3Hx2RQ.webp)

### Operating system

Arch Linux

### Browser information

Firefox 149.0.2

### URL for webapp

app.element.io

### Application version

Element version: 1.12.15, Crypto version: Rust SDK 0.16.0 (1ac734e), Vodozemac 0.9.0

### Homeserver

local ([Hammerhead v0.0.1-dev+g64ebc75](https://codeberg.org/timedout/hammerhead/commit/64ebc75da41b6127210d71b2af90f966e988c44a))

### Will you send logs?

Yes

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.