matrix-org / matrix-org/matrix-spec
Clarify authentication for /_matrix/identity/v2/3pid/unbind
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 330
- Forks
- 150
- Avg merge
- 2h 21m
- Merged PRs (30d)
- 3
Description
**Link to problem area**:
https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-3pid-unbind
**Issue**
The spec says:
> The identity server should authenticate the request in one of two ways:
>
> 1. The request is signed by the homeserver which controls the `user_id`.
> 2. The request includes the `sid` and `client_secret` parameters, as per `/3pid/bind`, which proves ownership of the 3PID.
Is this a second level of authentication, meaning that you still need an Identity Service API access token?
Also, concerning the first method of authentication: should the request be signed using the same scheme as the [federation API](https://matrix.org/docs/spec/server_server/latest#request-authentication)? Or should it be as mentioned in the [spec appendices](https://matrix.org/docs/spec/appendices#signing-json)?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the linked /_matrix/identity/v2/3pid/unbind section, then compare its authentication wording with the /3pid/bind reference, federation API request authentication, and signing JSON appendix. Clarify whether an Identity Service API access token is also required and which signing scheme applies; the specification is done when both questions are answered unambiguously.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100