element-hq / element-hq/synapse
Inconsistenly using pre-stored params for UI auth
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#8968](https://github.com/matrix-org/synapse/issues/8968).
---
We have two methods from the handler that get called on each request to complete UI auth, the aptly named [`validate_user_via_ui_auth`](https://github.com/matrix-org/synapse/blob/c9c1c9d82f190abc2f1254f75fe42bf29eff08e1/synapse/handlers/auth.py#L279-L325) and a lower-level method: [`check_ui_auth`](https://github.com/matrix-org/synapse/blob/c9c1c9d82f190abc2f1254f75fe42bf29eff08e1/synapse/handlers/auth.py#L407-L453).
All endpoints call `validate_user_via_ui_auth` (which calls `check_ui_auth` under the hood) except those that don't yet have an known requester (register and password reset) which directly call `check_ui_auth`.
Per matrix-org/matrix-doc#2907, the parameters of the original request to UI auth get persisted and only need to be provided once to Synapse. Unfortunately it seems that most of the endpoints which call `validate_user_via_ui_auth` completely disregard this and ignore the return values, using only the parameters from the most recent request.
Contributor guide
Assessment
This issue has not been assessed yet.