element-hq / element-hq/synapse

Inconsistenly using pre-stored params for UI auth

Open
#8,968 0 comments 0 reactions 0 assignees View on GitHub
z-auth z-bug z-p3
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#8968](https://github.com/matrix-org/synapse/issues/8968).

---

We have two methods from the handler that get called on each request to complete UI auth, the aptly named [`validate_user_via_ui_auth`](https://github.com/matrix-org/synapse/blob/c9c1c9d82f190abc2f1254f75fe42bf29eff08e1/synapse/handlers/auth.py#L279-L325) and a lower-level method: [`check_ui_auth`](https://github.com/matrix-org/synapse/blob/c9c1c9d82f190abc2f1254f75fe42bf29eff08e1/synapse/handlers/auth.py#L407-L453).

All endpoints call `validate_user_via_ui_auth` (which calls `check_ui_auth` under the hood) except those that don't yet have an known requester (register and password reset) which directly call `check_ui_auth`.

Per matrix-org/matrix-doc#2907, the parameters of the original request to UI auth get persisted and only need to be provided once to Synapse. Unfortunately it seems that most of the endpoints which call `validate_user_via_ui_auth` completely disregard this and ignore the return values, using only the parameters from the most recent request.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.