70 "Your Riot Validation Token" emails received for new account

[niedzielski]

I created a new riot.im account and quickly received 70 emails with "Your Riot Validation Token" in the subject. They all seem to contain the same message:

Hello,

We have received a request from <my IP address> to register this email address on riot.im. If this was you who made this request, you may use the following link to complete the verification of your email address:

Complete email verification

Please note that Riot requires Chrome, Firefox or Safari on the web, or iOS or Android on mobile.

If you aren't aware of making such a request, please disregard this email.

thanks,

Riot

I confirmed the address within the first 10-20 messages but they kept coming for a bit. They might still be coming and my email provider has just banned the sender.

[niedzielski]

Reported fixed by Matthew at about 0000 GMT:

an API changed in synapse's registration process which interacted very badly with the current live Riot-web app :(
and it looks as if the API may have been accidentally deployed in production before being tested
not sure this was a branching screwup; more someone accidentally updating production code when they actually meant to just update production config
and so doing an accidental deploy :(

Matthew is emailing those affected. I've not received an email but perhaps my provider (1and1 via Gmail) is blocking the domain.

[ara4n]

Everyone affected should have received an apologetic email at 00:20 GMT.

This looks to be due to matrix-org/synapse#1160 having accidentally made its way onto the production matrix.org homeserver and interacting badly with riot.im/app, which tight-looped on registration.

[ara4n]

ftr the root cause of this was matrix-org/matrix-react-sdk#510 (exposed by the server API refinement)

[niedzielski]

I later received the follow-up email and notification mails seem to be working too.