User-Interactive Authentication: What to respond when a client attempts to complete an already-completed stage?

[joepie91]

In the User-Interactive Authentication part of the specification, it states that the response contains an array of completed stages, as well as how to handle authentication stage attempts.

However, it does not specify what the correct behaviour would be if the client attempts to authenticate to a stage that has already been completed. Should it:

1. Silently ignore the attempt, and return the same response as before, with the 'completed stages' unchanged?
2. Reattempt authentication of that stage as if it was never in the 'completed stages' list to begin with?
3. Return a 401 (incorrect authentication details) response?
4. Return a 400 or 422 (bad/invalid request) response?
5. Something else?

In particular considering the potential need for supporting retransmission of authentication attempts when the connection is shaky, I suspect that it should be option 1 or 2, but I'm not sure.

[turt2live]

Although Synapse doesn't care, the language of the spec implies that completed stages cannot be retried. For re-transmission: the client could submit the stage again, and the server return an authentication error.

[uhoreg]

Would it not be better to allow clients to re-submit the last stage, in the case e.g. where a proxy eats the server's response to the client and the client doesn't know if the last stage succeeded?

[turt2live]

The server would process it as "hey, you already did that: see? [completed_flows]" rather than try and re-validate