matrix-org / matrix-org/matrix-rust-sdk
Ongoing outgoing requests to CS API after logout
Open
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 2.3k
- Forks
- 500
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 106
Description
In a rageshake, the user logged out, and logged in as a new user, but the application was still making requests to the CS API for the old server.
This seems like a waste of resources at the very least, but possibly also a concerning data leak?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the logout and new-login sequence described in the rageshake, then trace the session lifecycle and outgoing CS API requests. Done means requests for the old server stop after logout and do not continue under the new login, with the behavior covered by a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100