This repository has been archived by the owner on Apr 26, 2024. It is now read-only.
Send password reset from HS: Accepting the token #5368
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This changes the default behaviour of Synapse to send password reset emails itself rather than through an identity server. The reasoning behind the change is to prevent a malicious identity server from being able to initiate a password reset attempt and then answering it, successfully resetting their password, all without the user's knowledge. This also aides in decentralisation by putting less trust on the identity server itself, which traditionally is quite centralised. If users wish to continue with the old behaviour of proxying password reset requests through the user's configured identity server, they can do so by setting email.enable_password_reset_from_is to True in Synapse's config. Users should be able that with that option disabled (the default), password resets will now no longer work unless email sending has been enabled and set up correctly.
…reset_sending_email
This reverts commit 6d2d3c9.
… password resets This PR creates an endpoint GET/POST /_matrix/identity/api/v1/validate/email/submitToken which mirrors the same endpoint on the identity server used for submitting tokens used for validating 3PID addresses. When the token is submitted, it is checked along with the client_secret and session_id in the db and if it matches and isn't expired, we mark the session as validated. Then, when the user attempts to change their password, we check if the session is valid, and if so allow it. We also delete the session at this point, as as far as I can tell there's no further use for it.
anoadragon453
changed the title
Codecov Report
@@ Coverage Diff @@
## anoa/feature_hs_password_resets #5368 +/- ##
=================================================================
Coverage ? 62.7%
=================================================================
Files ? 343
Lines ? 35840
Branches ? 5866
=================================================================
Hits ? 22474
Misses ? 11792
Partials ? 1574 |
Codecov Report
@@ Coverage Diff @@
## anoa/feature_hs_password_resets #5368 +/- ##
==================================================================
Coverage ? 59.96%
==================================================================
Files ? 341
Lines ? 35840
Branches ? 5559
==================================================================
Hits ? 21492
Misses ? 12828
Partials ? 1520 |
erikjohnston
approved these changes
Jun 6, 2019
anoadragon453
added a commit
that referenced
this pull request
Jun 6, 2019
…identity server (#5377) Sends password reset emails from the homeserver instead of proxying to the identity server. This is now the default behaviour for security reasons. If you wish to continue proxying password reset requests to the identity server you must now enable the email.trust_identity_server_for_password_resets option. This PR is a culmination of 3 smaller PRs which have each been separately reviewed: * #5308 * #5345 * #5368
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR creates an endpoint GET/POST /_matrix/identity/api/v1/validate/email/submitToken
which mirrors the same endpoint on the identity server used for submitting tokens
used for validating 3PID addresses.
When the token is submitted, it is checked along with the client_secret and session_id in
the db and if it matches and isn't expired, we mark the session as validated. Then, when
the user attempts to change their password, we check if the session is valid, and if so
allow it. We also delete the session at this point, as as far as I can tell there's no
further use for it.
Code is based on #5345.