Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MSC2425: Remove Authentication on /submitToken Identity Service API #2425

Open
wants to merge 1 commit into
base: old_master
Choose a base branch
from
Open

MSC2425: Remove Authentication on /submitToken Identity Service API #2425

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions proposals/2425-no-auth-on-submit-token.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# Remove Authentication on /submitToken Identity Service API

[MSC2140](https://github.com/matrix-org/matrix-doc/pull/2140) added
authentication to `v2` endpoints of the Identity Service API. A few endpoints
were exempt from this requirement, but others were not.

As a result, two that do require authentication are the `/submitToken`
endpoints:

* [`GET /_matrix/identity/v2/validate/email/submitToken`](https://matrix.org/docs/spec/identity_service/r0.3.0#get-matrix-identity-v2-validate-email-submittoken)
* [`GET /_matrix/identity/v2/validate/msisdn/submitToken`](https://matrix.org/docs/spec/identity_service/r0.3.0#get-matrix-identity-v2-validate-msisdn-submittoken)

These endpoints are meant to be called by a user's browser when they click a
validation link in their email. These links do not contain access tokens, as
that would be a major security risk.

Additionally, while access tokens are intended to identify a user and bring
authentication, these particular endpoints already contain session ID,
client_secret and token parameters, which serve to identify and authenticate
the user already. Thus a general access token serves no purpose here.

## Proposal

The above mentioned endpoints should have the requirement of authentication
removed.

## Potential issues

None. Riot web and mobile clients (which are the only currently known
implementations of v2 3PID validation) already operate this way. The spec is
just wrong here.
Comment on lines +30 to +31
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The spec is just wrong here

citation needed - please point to the MSC where the spec incorrectly inferred that authentication is required on these endpoints (which would make this MSC not needed) or remove this claim.


## Security considerations

As stated above, the existing parameters already serve to authenticate the
user making the request.

The alternative that the spec suggests, sending an access token as part of a
validation email, is far more dangerous.