element-hq / element-hq/lk-jwt-service
Domain delegation not fully respected
- Dominant language
- Rust
- Stars
- 111
- Forks
- 35
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 19
Description
**Describe the bug**
lk-jwt-service seems to follow configured domains in .well-known/matrix/server but fails to adjust the query string. The error I receive is: `Failed to look up user info: Get "matrix://example.org/_matrix/federation/v1/openid/userinfo?access_token=": tls: failed to verify certificate: x509: certificate is valid for proxy1.int.example.org, not example.org`
**To Reproduce**
Steps to reproduce the behavior:
1. Setup Nginx and Synapse as described in the context section
2. Configure delegation as described in the context section
3. Try to start call.
**Expected behavior**
The call is correctly established.
**Desktop (please complete the following information):**
- Ubuntu 24.04 LTS
- Element Desktop 1.12.0
**Smartphone (please complete the following information):**
- Device: Pixel 8a
- OS: GrapheneOS
- Element X 25.03.1
**Additional context**
I've got my homeserver running on chat.example.org, the servername is set to example.org. I've correctly set up example.org/.well-known/matrix/server to return chat.example.org:443 and federation with foreign homeservers works flawlessly.
The homeserver on chat.example.org is proxied by Nginx (internal name: proxy1.int.example.org), which is a different server than the one serving example.org (and thus example.org/.well-known/matrix/server). The proxy server's default server block uses a self-signed certificate for domain "proxy1.int.example.org", and it has *no* server block for `example.org` (thus all requests for example.org are catched by the default server `proxy1.int.example.org`)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.