Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

When submitting a wrong token to validate a phone number the error is not correct #8218

Open
bmarty opened this issue Aug 31, 2020 · 5 comments
Labels
A-3PID 3rd party identifiers: e.g. email, phone number O-Uncommon Most users are unlikely to come across this or unexpected workflow S-Tolerable Minor significance, cosmetic issues, low or no impact to users. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues.

Comments

@bmarty
Copy link

bmarty commented Aug 31, 2020

When adding a phone number to an account, the user receive a submit_url in the response, and also a text message on the phone with a token composed by 6 digits.

When submitting a wrong token with

curl -X POST --data $'{"client_secret":"8f4285f7-ace9-4645-b545-e55e0566ab07","sid":"821337013","token":"111111"}' \
-H "Authorization: Bearer MDAxOGxvY2F0aW9uIG1hdHJp_REDACTED" \
'https://matrix-client.matrix.org/_matrix/client/unstable/add_threepid/msisdn/submit_token'

The user receive an error 400 with the following body:

{
  "errcode": "M_UNKNOWN",
  "error": "Error contacting the identity server"
}

The errcode should be more specific for instance "M_INVALID_TOKEN" (see matrix-org/sydent#292) and the error value is really confusing, because there is no identity server at all on the loop.

@babolivier
Copy link
Contributor

babolivier commented Sep 1, 2020

the error value is really confusing, because there is no identity server at all on the loop.

Just to give more context around this, there is an IS in the loop as Synapse delegates MSISDN validation to Sydent (as it doesn't know how to do it.

I think the next step is to change the Synapse code so that it forwards the error from the identity server.

@babolivier babolivier added A-3PID 3rd party identifiers: e.g. email, phone number z-bug (Deprecated Label) z-p2 (Deprecated Label) labels Sep 1, 2020
@richvdh
Copy link
Member

richvdh commented Sep 3, 2020

I'm afraid we've got too much customer work going on at the moment to be able to prioritise this. Let us know if it's a big issue for you and we can reconsider

@bmarty
Copy link
Author

bmarty commented Sep 3, 2020

This is not a big issue, and Element Android understands the error response correctly, so there is no rush.

@bmarty
Copy link
Author

bmarty commented Sep 3, 2020

@babolivier from client POV there is no identity server on the loop :). Internal delegation should stay internal.

@babolivier
Copy link
Contributor

Yes, that makes sense, I was just giving more context to explain why the error message is currently like that :)

@erikjohnston erikjohnston added S-Tolerable Minor significance, cosmetic issues, low or no impact to users. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues. O-Uncommon Most users are unlikely to come across this or unexpected workflow and removed z-bug (Deprecated Label) z-p2 (Deprecated Label) labels Dec 4, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
A-3PID 3rd party identifiers: e.g. email, phone number O-Uncommon Most users are unlikely to come across this or unexpected workflow S-Tolerable Minor significance, cosmetic issues, low or no impact to users. T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues.
Projects
None yet
Development

No branches or pull requests

4 participants