element-hq / element-hq/synapse
When submitting a wrong token to validate a phone number the error is not correct
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#8218](https://github.com/matrix-org/synapse/issues/8218).
---
When adding a phone number to an account, the user receive a `submit_url` in the response, and also a text message on the phone with a token composed by 6 digits.
When submitting a wrong token with
```sh
curl -X POST --data $'{"client_secret":"8f4285f7-ace9-4645-b545-e55e0566ab07","sid":"821337013","token":"111111"}' \
-H "Authorization: Bearer MDAxOGxvY2F0aW9uIG1hdHJp_REDACTED" \
'https://matrix-client.matrix.org/_matrix/client/unstable/add_threepid/msisdn/submit_token'
```
The user receive an error 400 with the following body:
```json
{
"errcode": "M_UNKNOWN",
"error": "Error contacting the identity server"
}
```
The `errcode` should be more specific for instance "M_INVALID_TOKEN" (see https://github.com/matrix-org/sydent/issues/292) and the `error` value is really confusing, because there is no identity server at all on the loop.
Contributor guide
Research direction
Start by reproducing the wrong-token request against the `_matrix/client/unstable/add_threepid/msisdn/submit_token` endpoint and trace where its 400 response is generated. Check the surrounding phone-number validation and identity-server error handling; done means an invalid token returns a specific errcode such as `M_INVALID_TOKEN` and an accurate error message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100