element-hq / element-hq/synapse
Re-clicking on email validation link breaks with ugly error page
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#12658](https://github.com/matrix-org/synapse/issues/12658).
---
Moved from https://github.com/vector-im/element-web/issues/13002
### Description
Synapse now deletes 3pid validation sessions once they've been checked: https://github.com/matrix-org/synapse/blob/a00462dd9927558532b030593f8914ade53b7214/synapse/handlers/ui_auth/checkers.py#L195
So if you click on an email validation link again you get dumped into an unstyled page from synapse telling you the validation failed because of an unknown session_id.

Previously this took the user straight into their account again, for as long as the validation session remained valid. This is quite nice from a UX perspective but does offer a way into your account if the validation secret is somehow compromised.
Not entirely clear what the correct thing to do here is, but it should probably not be an unstyled error page.

Contributor guide
Assessment
This issue has not been assessed yet.