element-hq / element-hq/hydrogen-web
Lost olm sessions due to storage being cleared are never replaced with a new one, resulting in UTDs
- Dominant language
- TypeScript
- Stars
- 714
- Forks
- 131
- PR merge metrics
- No merged PRs in 30d
Description
One way an olm session can get "wedged" is when indexeddb is cleared by the browser. The olm account is backed (since 77bd0d3f3) up to localstorage (which _usually_ isn't cleared), but the olm sessions are not. So if the olm session is lost and another client sends us a to_device message encrypted with that session, we would see either a `BAD_MESSAGE_KEY_ID` or `OLM_NO_MATCHING_SESSION` error depending on whether we have already sent an olm message from our device to their device or not.
To solve this, we should implement #629, which here would mean setting up a new olm session and sending a `m.dummy` message over it, and then re-request the key with a key sharing using a `m.room.key_request` message.
Contributor guide
Research direction
Start by reading the referenced issue #629 and tracing how lost olm sessions produce BAD_MESSAGE_KEY_ID or OLM_NO_MATCHING_SESSION errors after IndexedDB is cleared. Done means a new olm session is established, an m.dummy message is sent over it, and the key is requested again with m.room.key_request.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100