element-hq / element-hq/synapse

Register race condition: Consent not given

Open
#5,451 0 comments 0 reactions 0 assignees View on GitHub
A-Registration O-Uncommon S-Major T-Defect z-bug z-p2
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#5451](https://github.com/matrix-org/synapse/issues/5451).

---

Right at the end of the register method (https://github.com/matrix-org/synapse/blob/master/synapse/rest/client/v2_alpha/register.py#L496) it does some `post_registration_actions` on newly registered accounts. It skips these actions if the account was previously registered in the same UI auth session. When the server is being slow enough, a request can come in, get the already-registered user and return it whilst the first request is still processing the `post_registration_actions`. This can result in a user getting a session for their account before the `post_registration_actions` have been completed which can in turn result in users being told they haven't consented to the terms & conditions when they try to create a room (or when their client automatically starts a chat with riot-bot).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.