element-hq / element-hq/synapse
Synapse accepts /forget without a request body but this is not meant to be allowed by the specification
Open
A-Spec-Compliance
O-Uncommon
S-Tolerable
T-Defect
Z-Future-Maintenance
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#16366](https://github.com/matrix-org/synapse/issues/16366).
---
Like all PUT and POST requests other than the media ones (and `/logout`...), `/forget` is supposed to take a JSON body, e.g. `{}` if nothing special is required. Currently Synapse as at v1.92.3 does not require this.
#16365 adds a warning against this.
We should see if any clients are hitting this and then a future version should cut this off completely.
Contributor guide
Assessment
This issue has not been assessed yet.