matrix-org / matrix-org/matrix-spec

Soft Logout does not play well on servers with multiple login flows

Open
#717 1 comment 0 reactions 1 assignee View on GitHub

@turt2live is already working on this.

Since Feb 23, 2022.

improvement
Dominant language
HTML
Stars
330
Forks
150
Avg merge
2h 21m
Merged PRs (30d)
3

Description

Describe the bug
If your Matrix Homeserver has SSO and Username + Password support then Soft Logout will give both options to the user, when in fact there is only one that will work and the other will butcher their local data.
This is because as far as the spec is concerned, Soft Logout docs don't tell clients to send any identifying marks along with the GET /login so the flows that the server returns cannot be at all personalised/scoped.

Expected behavior
Clients should tell Servers their soft-logged-out user-id or something of that nature to allow the server to personalise the flows to only the ones that make sense for that user. Using user-id is probably a bad idea as it'd open a door for anyone to find out what flow a user used to log in and make their account that 1% more vulnerable.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.