element-hq / element-hq/lk-jwt-service

Domain delegation not fully respected

Open
#122 12 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
111
Forks
35
Avg merge
1d 14h
Merged PRs (30d)
19

Description

**Describe the bug**
lk-jwt-service seems to follow configured domains in .well-known/matrix/server but fails to adjust the query string. The error I receive is: `Failed to look up user info: Get "matrix://example.org/_matrix/federation/v1/openid/userinfo?access_token=": tls: failed to verify certificate: x509: certificate is valid for proxy1.int.example.org, not example.org`

**To Reproduce**
Steps to reproduce the behavior:
1. Setup Nginx and Synapse as described in the context section
2. Configure delegation as described in the context section
3. Try to start call.

**Expected behavior**
The call is correctly established.

**Desktop (please complete the following information):**
- Ubuntu 24.04 LTS
- Element Desktop 1.12.0

**Smartphone (please complete the following information):**
- Device: Pixel 8a
- OS: GrapheneOS
- Element X 25.03.1

**Additional context**

I've got my homeserver running on chat.example.org, the servername is set to example.org. I've correctly set up example.org/.well-known/matrix/server to return chat.example.org:443 and federation with foreign homeservers works flawlessly.

The homeserver on chat.example.org is proxied by Nginx (internal name: proxy1.int.example.org), which is a different server than the one serving example.org (and thus example.org/.well-known/matrix/server). The proxy server's default server block uses a self-signed certificate for domain "proxy1.int.example.org", and it has *no* server block for `example.org` (thus all requests for example.org are catched by the default server `proxy1.int.example.org`)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.