MSC4127: Removal of query string auth

[turt2live]

Rendered

In line with matrix-org/matrix-spec#1700, the following disclosure applies:

I am Director of Standards Development at The Matrix.org Foundation C.I.C., Matrix Spec Core Team (SCT) member, employed by Element, and operate the t2bot.io service. This proposal is written and published with my role as a member of the SCT.

Requires #4126
Fixes matrix-org/matrix-spec#1780

---

SCT Stuff:

No MSC checklist

FCP tickyboxes

[turt2live]

Implementation requirements:

• None, in my opinion. The MSC is not feasible to implement beyond what has already been described in the proposal itself.

[tulir]

I looked through https://matrix.org/ecosystem/ and found the following projects that seemed to still be using the query parameter:

• Client SDKs
  • libcmatrix: https://source.puri.sm/Librem5/libcmatrix/-/blob/c4e9a8552f6870829a987820cc0f66323dd5e9ff/src/cm-net.c#L271 fixed by https://source.puri.sm/Librem5/libcmatrix/-/commit/968e31184c675d48bf7610a48cca79d557eae95e
  • Matrix-ClientServer-API-java: https://github.com/JojiiOfficial/Matrix-ClientServer-API-java/blob/cb733066b8cc0c1ea51047efba8212de67965331/src/main/java/de/jojii/matrixclientserver/Bot/Syncee.java#L83 (cc @JojiiOfficial)
  • I couldn't find how https://github.com/Dominaezzz/matrix-kt does auth, but it's archived
• Bot SDKs
  • MatrixBot .NET Core SDK: https://github.com/enimatek-nl/matrixbot-dotnet-sdk/blob/adebefc612de3f002a1f1cc3183923745876709a/MatrixBot.Sdk/MatrixBot.cs#L202
  • simplematrixbotlib: https://codeberg.org/imbev/simplematrixbotlib/src/commit/17ead9cb2cc86b09e39c21acc015ad1500d4ed4b/simplematrixbotlib/api.py#L112 (I think it uses matrix-nio for most requests, so probably just that one outdated request) fixed by https://codeberg.org/imbev/simplematrixbotlib/commit/6522377ebcd1da58f6912cd17696a2dac6dd791e
  • mxbt: https://codeberg.org/librehub/mxbt/src/commit/aee47b2a47c2e997277c727dac61d301850785de/mxbt/bot.py#L127 (seems to be copied from simplematrixbotlib)
• Bots
  • Time-to-Matrix: https://github.com/etkecc/ttm/blob/b9e80e9977eb257b677e25346ea720ae336d5e6b/internal/matrix/matrix.go#L185 (cc @aine-etke)
  • hemppa: https://github.com/vranki/hemppa/blob/907a73eb36e5e2b38dbd3ec35503baf91ec7404a/bot.py#L543 fixed by vranki/hemppa@03b720c
• Bridges: none
• Clients: none (but Chatty uses libcmatrix mentioned above)

There are also a bunch of matches on GitHub search, but I'd guess most of them are ad-hoc scripts, unmaintained projects and other such things: https://github.com/search?q=%2F_matrix+access_token%3D++NOT+is%3Aarchived+NOT+is%3Afork&type=code

[tulir]

Not sure how GitHub sorts those search results, but when I opened it again, the order had changed and the top result was GitLab. Should probably open an issue or PR for them 🤔 https://gitlab.com/gitlab-org/gitlab/-/blob/v17.8.0-ee/app/models/integrations/matrix.rb#L7

Looked through some of the search results, others that are probably worth notifying:

• https://github.com/sitespeedio/sitespeed.io/blob/f8a6408b7c0b6734e68976dbd9db93070f8d21ea/lib/plugins/matrix/send.js#L20
• https://github.com/badges/shields/blob/152b8e9a64623ce5677c1ef3cd802f7291855611/services/matrix/matrix.service.js#L200 (apparently shields.io still defaults to guest access for non-matrix.org servers, and the guest access uses the query param)
• https://github.com/netdata/netdata/blob/fa91f42a15470c6ed1d478cbe40f89de81d2d6b8/src/health/notifications/alarm-notify.sh.in#L2099
• https://github.com/TwiN/gatus/blob/fa3e5dcc6e0138953042d0ac68c576f13e6c10ad/alerting/provider/matrix/matrix.go#L106

[turt2live]

libcmatrix, simplematrixbotlib, mxbt, ttm, and hemppa appear to fit a definition of 'maintained', so may be quickly fixed by the pings (hopefully).

I've tried starting a fix for gitlab, but forking the project is taking too long, so will have to be another time if no one else does it :D

[tulir]

GitLab seems to have some kind of system where you don't have to make your own fork https://docs.gitlab.com/ee/development/contributing/first_contribution/index.html

It automatically sent an access request without further prompting when I clicked the link in the second bullet point, so I guess I'll try making a patch too :D

[tulir]

https://gitlab.com/gitlab-org/gitlab/-/merge_requests/178475

[clokep]

An issue that Synapse ran into with MSC2832 which removed query parameter auth for app services is that we did not want to drop support for old spec versions, but did want to follow this guidance. (matrix-org/synapse#15379 has some of the discussion.)

We ended up saying Synapse was still compatible with 1.4, but had a configuration flag for re-enabling the old behavior (disabling it by default in the name of secure defaults).

---

I'm not sure if I have a recommendation, but wanting to be both backwards compatible and secure by default was difficult in this situation. I guess one option would have been to only declare support for the older versions if the config flag was flipped, but I think various clients would have stopped working if we did that.

[turt2live]

We've run into a number of cases over the last few years where the spec tries to remove a feature, but implementations can't meaningfully do that without dropping support for old spec versions (which they don't want to do).

I do feel it's important we figure out how we can remove things without dropping old spec version support, but I also feel like it's important to at least clean up the spec for newer implementations to start from. A future, different, proposal can address the removal concerns more broadly, in my opinion.

[agx]

libcmatrix, simplematrixbotlib, mxbt, ttm, and hemppa appear to fit a definition of 'maintained', so may be quickly fixed by the pings (hopefully).

I'm more of a drive by contributor to libcmatrix but put out a patch here: https://source.puri.sm/Librem5/libcmatrix/-/merge_requests/104 . Is there a recommendation for falling back to the query parameter for older (pre 1.4? versions)?

[tulir]

No need for fallbacks, the Authorization header has been supported since r0.3.0 (released in 2017) https://spec.matrix.org/legacy/client_server/r0.3.0.html#client-authentication

[imbev]

Addressed in simplematrixbotlib v2.12.2 https://codeberg.org/imbev/simplematrixbotlib/commit/6522377ebcd1da58f6912cd17696a2dac6dd791e

[turt2live]

This got stuck a couple of years ago due to concerns about not actually being able to "remove" something from the spec. Mentioned in #4127 (comment) though, I'd like to see us clean up the spec and (continue to) punt the removal problem down the road to a future MSC.

I'll commit to thinking about the removal problem, but can't promise any particular timeline or MSCs will result from it.

@mscbot fcp merge

[mscbot]

Team member @turt2live has proposed to merge this. The next step is review by the rest of the tagged people:

• @clokep
• @dbkr
• @uhoreg
• @turt2live
• @ara4n
• @anoadragon453
• @richvdh
• @tulir
• @erikjohnston
• @KitsuneRal

Once at least 75% of reviewers approve (and there are no outstanding concerns), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for information about what commands tagged team members can give me.

[mscbot]

🔔 This is now entering its final comment period, as per the review above. 🔔

[mscbot]

The final comment period, with a disposition to merge, as per the review above, is now complete.

[turt2live]

Spec PR: matrix-org/matrix-spec#2408

[turt2live]

Merged 🎉