element-hq / element-hq/synapse

Re-clicking on email validation link breaks with ugly error page

Open
#12,658 0 comments 0 reactions 0 assignees View on GitHub
A-Registration T-Enhancement
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#12658](https://github.com/matrix-org/synapse/issues/12658).

---

Moved from https://github.com/vector-im/element-web/issues/13002

### Description

Synapse now deletes 3pid validation sessions once they've been checked: https://github.com/matrix-org/synapse/blob/a00462dd9927558532b030593f8914ade53b7214/synapse/handlers/ui_auth/checkers.py#L195

So if you click on an email validation link again you get dumped into an unstyled page from synapse telling you the validation failed because of an unknown session_id.

![image](https://user-images.githubusercontent.com/2403652/167198647-347e8489-722e-4764-8167-a30553d84810.png)

Previously this took the user straight into their account again, for as long as the validation session remained valid. This is quite nice from a UX perspective but does offer a way into your account if the validation secret is somehow compromised.

Not entirely clear what the correct thing to do here is, but it should probably not be an unstyled error page.

![image](https://user-images.githubusercontent.com/2403652/167198551-f5dad810-1fda-42a1-83be-371189b6a3c8.png)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.