element-hq / element-hq/synapse
/r0/account/3pid/email/requestToken could be authenticated
Open
O-Occasional
S-Minor
T-Defect
Z-Spec-Blocked
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#9414](https://github.com/matrix-org/synapse/issues/9414).
---
The `/r0/account/3pid/email/requestToken` endpoint could be authenticated since the only valid use case for binding 3PIDs is to bind them to your own account. This would allow us to implement additional rate-limiting. Additionally, we could ensure that the MXID the email address is bound to and the MXID that initiated the binding process are one and the same.
This would necessitate a spec change.
Contributor guide
Assessment
This issue has not been assessed yet.