Password reset using email is broken

[Twi1ightSparkle]

Description

Resetting your password using email on #/forgot_password is broken

Steps to reproduce

• Enter your email on #/forgot_password (assuming your account already have a verified email attached)
• Click the link in the email
  
• Click I have verified my email address
• You get the error message Failed to verify email address: make sure you clicked the link in the email
  

Homeserver

matrix.org, <redacted>.ems.host

Synapse Version

Issue present on at least 1.68.0, 1.70.1, and 1.70.1 (b=matrix-org-hotfixes,18a045ba69)

Installation Method

No response

Platform

Matrix.org and EMS

Relevant log output

Will attach to an internal issue

Anything else that would be useful to know?

No response

[TheloTheGreat]

I also have this problem on 1.64.0.

From looking at my server logs, there seems to be a URL-parsing problem there. The log shows a password reset attempt where the URL has a "sid" parameter just fine, but then it complains that it's "Missing string query parameter 'sid'" and then complains about an "Invalid base64-encoded string":

2022-10-30 15:10:31,414 - synapse.access.http.8008 - 450 - INFO - GET-47717 - 96.127.204.3 - 8008 - {None} Processed request: 0.000sec/-0.000sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 706B 200 "GET /_synapse/client/password_reset/email/submit_token?token=JjMMVTFVybkRvlJMJQVUJcLCNiGjTzrV&client_secret=<redacted>&sid=CMNoWHTXFgygOjlE HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:106.0) Gecko/20100101 Firefox/106.0" [0 dbevts]
2022-10-30 15:10:32,007 - synapse.http.server - 234 - INFO - GET-47718 - <XForwardedForRequest at 0x7fd0646b16c0 method='GET' uri='/_synapse/client/password_reset/email/submit_token?client_secret=<redacted>' clientproto='HTTP/1.1' site='8008'> SynapseError: 400 - Missing string query parameter 'sid'
2022-10-30 15:10:32,007 - synapse.access.http.8008 - 450 - INFO - GET-47718 - 157.55.39.113 - 8008 - {None} Processed request: 0.001sec/-0.000sec (0.000sec, 0.000sec) (0.000sec/0.000sec/0) 192B 400 "GET /_synapse/client/password_reset/email/submit_token?client_secret=<redacted> HTTP/1.1" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; MicrosoftPreview/2.0; +https://aka.ms/MicrosoftPreview) Chrome/100.0.4896.127 Safari/537.36" [0 dbevts]
2022-10-30 15:10:33,389 - synapse.access.http.8008 - 450 - INFO - POST-47719 - 96.127.204.3 - 8008 - {None} Processed request: 0.003sec/-0.000sec (0.000sec, 0.001sec) (0.000sec/0.002sec/1) 169B 200 "POST /_synapse/client/password_reset/email/submit_token?token=JjMMVTFVybkRvlJMJQVUJcLCNiGjTzrV&client_secret=<redacted>&sid=CMNoWHTXFgygOjlE HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:106.0) Gecko/20100101 Firefox/106.0" [0 dbevts]
2022-10-30 15:10:40,086 - synapse.api.auth - 450 - WARNING - POST-47721 - Invalid access token in auth: <class 'binascii.Error'> Invalid base64-encoded string: number of data characters (9) cannot be 1 more than a multiple of 4.
2022-10-30 15:10:40,086 - synapse.http.server - 167 - INFO - POST-47721 - <XForwardedForRequest at 0x7fd06c6c92a0 method='POST' uri='/_matrix/client/r0/account/password' clientproto='HTTP/1.1' site='8008'> SynapseError: 401 - Invalid access token passed.
2022-10-30 15:10:40,087 - synapse.access.http.8008 - 450 - INFO - POST-47721 - 96.127.204.3 - 8008 - {None} Processed request: 0.001sec/0.001sec (0.001sec, 0.000sec) (0.000sec/0.000sec/0) 88B 401 "POST /_matrix/client/r0/account/password HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:106.0) Gecko/20100101 Firefox/106.0" [0 dbevts]

[DMRobertson]

When I try to do this (against a matrix.org account) from https://app.element.io/#/forgot_password, my client ends up calling POST | https://matrix-client.matrix.org/_matrix/client/r0/account/password with Authorization: Bearer undefined. Which smells like a javascript error to me.

Element-web 1.11.12.

[DMRobertson]

This seems to be a client-side issue, covered by element-hq/element-web#23655. I suppose we should have asked someone to test this in a different client.

[Twi1ightSparkle]

🤦‍♀️ I should have tested using !element

[DMRobertson]

No harm done!