element-hq / element-hq/element-web
Element relies on being able to one-shot user-interactive authentication for password changes
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
1. Sign in to your account
2. Navigate to account settings to change your password
3. Put your existing password and desired new password in, and hit "Change Password"
4. Element makes a single request to `POST /_matrix/client/v3/account/password` containing authentication data and the requested reset data
5. Element fails and shows an error to the user when the endpoint returns a user-interactive authentication challenge response
### Outcome
#### What did you expect?
Per [the spec](https://spec.matrix.org/v1.18/client-server-api/#user-interactive-authentication-api), Element should first send a request without authentication data to create a session, and then send a followup request with the authentication data for the session requested by the homeserver (as is done for registration, deactivation, and logging out other devices). For example:
```
POST /_matrix/client/v3/account/password HTTP/1.1
{"new_password": "..."}
HTTP/1.1 401 Unauthorized
{"auth": {"session": "foobar"}}
POST /_matrix/client/v3/account/password HTTP/1.1
{"auth": {"session": "foobar", "password": "currentPassword", "identifier": {"...":"..."}}, "new_password": "..."}
```
#### What happened instead?
Element sends all of the data in the same request, without a session, which some homeservers may reject and instead create a new UIA session, responding with the challenge. In this case, my homeserver does not support sessionless authentication (i.e. if the client does not provide a session, a new one is created, and the challenge is served immediately). Then, rather than re-sending the provided data in response to the challenge, Element shows a modal to the user with the less than helpful message "MatrixError: [401] Unknown message (http://.../_matrix/client/v3/account/password) (HTTP status 401)":
```
POST /_matrix/client/v3/account/password HTTP/1.1
{
"auth": {
"type": "m.login.password",
"identifier": {
"type": "m.id.user",
"user": "@test:localhost:8008"
},
"password": "D2b0a3006de42109931e5696@"
},
"new_password": "d2b0a3006de42109931e5696",
"logout_devices": false
}
HTTP/1.1 401 Unauthorized
{"completed":[],"errcode":"","error":"","flows":[{"stages":["m.login.password"]}],"session":"2YCzhYMiGJhlfOLQ"}
```
Then the following error:

### Operating system
Arch Linux
### Browser information
Firefox 149.0.2
### URL for webapp
app.element.io
### Application version
Element version: 1.12.15, Crypto version: Rust SDK 0.16.0 (1ac734e), Vodozemac 0.9.0
### Homeserver
local ([Hammerhead v0.0.1-dev+g64ebc75](https://codeberg.org/timedout/hammerhead/commit/64ebc75da41b6127210d71b2af90f966e988c44a))
### Will you send logs?
Yes
Contributor guide
Assessment
This issue has not been assessed yet.