element-hq / element-hq/synapse

Don't delete e-mail validation sessions when the checking if the session was validated

Open
#8,086 0 comments 0 reactions 0 assignees View on GitHub
z-bug z-p2
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#8086](https://github.com/matrix-org/synapse/issues/8086).

---

With the current e-mail validation flow the user can be presented with a blank white page that says "Unknown session_id" pretty easily. The flow is something like the following:

1. The user is sent a validation e-mail.
2. The e-mail validation link is clicked and Synapse ensures that the data matches and [marks the e-mail as valid](https://github.com/matrix-org/synapse/blob/66f24449dd614b23ea4c572d8d613efeb129e4a2/synapse/rest/client/v2_alpha/account.py#L609-L612).
3. The user gets redirected to wherever their client wants based on the `next_link` parameter.
4. If a user has left Element running somewhere (maybe in a background tab, or on another device) it continually polls in the background and notices that the [e-mail is now valid](https://github.com/matrix-org/synapse/blob/83434df3812650f53c60e91fb23c2079db0fb5b8/synapse/handlers/ui_auth/checkers.py#L166-L183)). It then deletes the e-mail validation session.
5. The application continues with whatever is left in the registration flow (or logs the user in).

Unfortunately it seems that [some e-mail providers](https://support.google.com/mail/thread/16878288?hl=en) do content scanning on links, so they automatically visit a link *before the user sees it*. With that, the flow is modified a bit:

1. Step 1 from above happens as expected.
2. Before the user sees the e-mail the link is visited.
3. Since there's an app polling in the background, steps 2 - 4 happen.
4. The user urgently refreshes their inbox waiting for their validation email.
5. Finally the user is able to click on the validation link.
6. "Unknown session_id" error page 😢

I think the fix for this is to not delete the validation session during the UI Auth workflow and to delete them periodically (as we do with the UI auth sessions).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.