Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

we do not correctly honour the validity period on server signing keys #4364

Open
richvdh opened this issue Jan 8, 2019 · 1 comment

Comments

2 participants
@richvdh
Copy link
Member

commented Jan 8, 2019

when we ask a server for its signing keys, it gives us a validity period, after which we should not accept federation requests signed by those keys, nor should we accept events with an origin_server_ts, unless we refresh the key list and it is still valid.

We need to start enforcing that

@richvdh

This comment has been minimized.

Copy link
Member Author

commented Jan 8, 2019

(this is likely to need a room version bump)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.