matrix-org / matrix-org/matrix-spec
Soft Logout does not play well on servers with multiple login flows
@turt2live is already working on this.
Since Feb 23, 2022.
- Dominant language
- HTML
- Stars
- 330
- Forks
- 150
- Avg merge
- 2h 21m
- Merged PRs (30d)
- 3
Description
Describe the bug
If your Matrix Homeserver has SSO and Username + Password support then Soft Logout will give both options to the user, when in fact there is only one that will work and the other will butcher their local data.
This is because as far as the spec is concerned, Soft Logout docs don't tell clients to send any identifying marks along with the GET /login so the flows that the server returns cannot be at all personalised/scoped.
Expected behavior
Clients should tell Servers their soft-logged-out user-id or something of that nature to allow the server to personalise the flows to only the ones that make sense for that user. Using user-id is probably a bad idea as it'd open a door for anyone to find out what flow a user used to log in and make their account that 1% more vulnerable.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.