Can not decrypt message in chrome in v2.5.2

[hoangdat]

Desc:

• Web (Chrome and Safari at least), we can not execute all the backup process after sign in

DoD:

• Should work as normal

[tprudentova]

Safari as well

[sherlockvn]

• Spend 2 points for testing and reproduce it

[sherlockvn]

The recoveryWords API in both matrix.linagora.com and matrix.lin-saas.com have 404 status

[sherlockvn]

i need to have the recoveryKey so that, i can continue debug about the message can't be decrypted. As the error message suggests, i guess that the recoverykey is deleted in database

[tjiho]

On firefox there is the same issue.
When I login, I have a 500 error on https://tom.linagora.com/_twake/recoveryWords with {"error":"duplicate key value violates unique constraint \"recoverywords_pkey\""}

[AudranBert]

On firefox there is the same issue. When I login, I have a 500 error on https://tom.linagora.com/_twake/recoveryWords with {"error":"duplicate key value violates unique constraint \"recoverywords_pkey\""}

Same issue here on firefox

[guimard]

Hi, the real issue is "why Chrome wants to replace recoveryWords which exists ? Does it means that it failed to get it previously or is it a wanted replacement ?

Anyway @rezk2ll is going to accept such replacement but the logical way should be to accept such replacement with a "PUT" request, not a "POST"

[rezk2ll]

Hi, the real issue is "why Chrome wants to replace recoveryWords which exists ? Does it means that it failed to get it previously or is it a wanted replacement ?

Anyway @rezk2ll is going to accept such replacement but the logical way should be to accept such replacement with a "PUT" request, not a "POST"

after debugging at first it fetches the recovery words and then it sends a POST request to insert a different set of recovery words

[guimard]

@hoangdat @Te-Z , any advice ?

[guimard]

Hi, the real issue is "why Chrome wants to replace recoveryWords which exists ? Does it means that it failed to get it previously or is it a wanted replacement ?
Anyway @rezk2ll is going to accept such replacement but the logical way should be to accept such replacement with a "PUT" request, not a "POST"

after debugging at first it fetches the recovery words and then it sends a POST request to insert a different set of recovery words

@rezk2ll: Looking at screnshots, the browser received a 404, that's why it wanted to post. The issue seems to be in the GET

[sherlockvn]

@guimard, I tried using a different homeserver, matrix.stg.lin-saas.com. I created a new account, and after uploading the recovery key successfully, I was able to retrieve the recovery words from the server with a 200 status. This indicates that the GET API is working correctly, but it appears that the database does not contain the key.

[hoangdat]

Hi @guimard ,
Front-end dev is investigating more, why after GET frontend call again POST?.
Maybe sth wrong in the new backup process.

[hoangdat]

Hi @tjiho , @AudranBert , can you show me your app version which has the problem?
Settings -> About

[Te-Z]

@sherlockvn @guimard @hoangdat when there's a failure when retrieving backup key and the user wants to have a new one, the app tries to wipe the previous key.

twake-on-matrix/lib/pages/bootstrap/tom_bootstrap_dialog.dart

Lines 176 to 180 in 4fb3d41

	case UploadRecoveryKeyState.wipeRecovery:
	WidgetsBinding.instance.addPostFrameCallback((_) {
	_wipeRecoveryWord();
	});
	break;

But this fail, IMO because there not existing key yet (but didn't had clear log about the error yet). The result is that UploadRecoveryKeyState 's new state is UploadRecoveryKeyState.wipeRecoveryFailed . Which triggers this:

twake-on-matrix/lib/pages/bootstrap/tom_bootstrap_dialog.dart

Lines 181 to 186 in 4fb3d41

	case UploadRecoveryKeyState.wipeRecoveryFailed:
	WidgetsBinding.instance.addPostFrameCallback((_) {
	TwakeSnackBar.show(context, L10n.of(context)!.cannotEnableKeyBackup);
	Navigator.of(context, rootNavigator: false).pop<bool>();
	});
	break;

I think the problem is that is this case, there's no new recovery key created because this part of the code is never called:

twake-on-matrix/lib/pages/bootstrap/tom_bootstrap_dialog.dart

Lines 313 to 320 in 4fb3d41

	case BootstrapState.askNewSsss:
	WidgetsBinding.instance.addPostFrameCallback(
	(_) => bootstrap?.newSsss().then(
	(_) =>
	_uploadRecoveryKeyState = UploadRecoveryKeyState.created,
	),
	);
	break;

@sherlockvn @hoangdat WDYT ?

[sherlockvn]

I confirmed that the 500 error is caused by the front-end team, and we have take care of that.

[guimard]

I confirmed that the 500 error is caused by the front-end team, and we have take care of that.

@rezk2ll prepared an MR to allow POST request to override existing key, I didn't merge it until you agree with this potentially dangerous behavior. Let us know what to do on backend part

[AudranBert]

Hi @tjiho , @AudranBert , can you show me your app version which has the problem? Settings -> About

Version: 2.5.9

[tprudentova]

Still happens on Chrome