element-hq / element-hq/synapse
Register race condition: Consent not given
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#5451](https://github.com/matrix-org/synapse/issues/5451).
---
Right at the end of the register method (https://github.com/matrix-org/synapse/blob/master/synapse/rest/client/v2_alpha/register.py#L496) it does some `post_registration_actions` on newly registered accounts. It skips these actions if the account was previously registered in the same UI auth session. When the server is being slow enough, a request can come in, get the already-registered user and return it whilst the first request is still processing the `post_registration_actions`. This can result in a user getting a session for their account before the `post_registration_actions` have been completed which can in turn result in users being told they haven't consented to the terms & conditions when they try to create a room (or when their client automatically starts a chat with riot-bot).
Contributor guide
Assessment
This issue has not been assessed yet.