MSC2832: HS -> AS authorization header #2832

tulir · 2020-10-24T15:28:04Z

This has been implemented by mautrix-python for a long time already, as I had mistakenly thought the spec was fixed long ago.

Signed-off-by: Tulir Asokan <tulir@maunium.net>

FCP Checkboxes

Signed-off-by: Tulir Asokan <tulir@maunium.net>

proposals/2832-appservice-auth-fix.md

turt2live · 2022-06-09T16:12:17Z

removing needs-implementation: we know this works from the client server API, and I'm not convinced it's overly complex for appservices/homeservers to send a header instead of query string.

In fact, I think it might even be reasonable to switch the spec to headers instead of supporting both.

Signed-off-by: Tulir Asokan <tulir@maunium.net>

turt2live · 2022-06-09T17:28:08Z

this is pretty trivial

@mscbot fcp merge

mscbot · 2022-06-09T17:28:10Z

Team member @turt2live has proposed to merge this. The next step is review by the rest of the tagged people:

Once at least 75% of reviewers approve (and there are no outstanding concerns), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for information about what commands tagged team members can give me.

Co-authored-by: Jonathan de Jong <jonathandejong02@gmail.com>

mscbot · 2022-07-17T13:34:43Z

The final comment period, with a disposition to merge, as per the review above, is now complete.

* Proposal to fix homeserver -> appservice authorization Signed-off-by: Tulir Asokan <tulir@maunium.net> * Remove query parameter entirely instead of deprecating it Signed-off-by: Tulir Asokan <tulir@maunium.net> * Update title Co-authored-by: Jonathan de Jong <jonathandejong02@gmail.com> Co-authored-by: Jonathan de Jong <jonathandejong02@gmail.com>

MSC: matrix-org/matrix-spec-proposals#2832

turt2live · 2022-08-03T00:40:30Z

Spec PR: matrix-org/matrix-spec#1200

* Use auth header instead of query param for hs->as comms MSC: matrix-org/matrix-spec-proposals#2832 * Fix for OpenAPI 2

turt2live · 2022-08-04T17:33:30Z

Merged 🎉

Upstream changes: Synapse 1.70.1 (2022-10-28) =========================== (bugfixes) Synapse 1.70.0 (2022-10-26) =========================== Features -------- - Support for [MSC3856](matrix-org/matrix-spec-proposals#3856): threads list API. ([\#13394](matrix-org/synapse#13394), [\#14171](matrix-org/synapse#14171), [\#14175](matrix-org/synapse#14175)) - Support for thread-specific notifications & receipts ([MSC3771](matrix-org/matrix-spec-proposals#3771) and [MSC3773](matrix-org/matrix-spec-proposals#3773)). ([\#13776](matrix-org/synapse#13776), [\#13824](matrix-org/synapse#13824), [\#13877](matrix-org/synapse#13877), [\#13878](matrix-org/synapse#13878), [\#14050](matrix-org/synapse#14050), [\#14140](matrix-org/synapse#14140), [\#14159](matrix-org/synapse#14159), [\#14163](matrix-org/synapse#14163), [\#14174](matrix-org/synapse#14174), [\#14222](matrix-org/synapse#14222)) - Stop fetching missing `prev_events` after we already know their signature is invalid. ([\#13816](matrix-org/synapse#13816)) - Send application service access tokens as a header (and query parameter). Implements [MSC2832](matrix-org/matrix-spec-proposals#2832). ([\#13996](matrix-org/synapse#13996)) - Ignore server ACL changes when generating pushes. Implements [MSC3786](matrix-org/matrix-spec-proposals#3786). ([\#13997](matrix-org/synapse#13997)) - Experimental support for redirecting to an implementation of a [MSC3886](matrix-org/matrix-spec-proposals#3886) HTTP rendezvous service. ([\#14018](matrix-org/synapse#14018)) - The `/relations` endpoint can now be used on workers. ([\#14028](matrix-org/synapse#14028)) - Advertise support for Matrix 1.3 and 1.4 on `/_matrix/client/versions`. ([\#14032](matrix-org/synapse#14032), [\#14184](matrix-org/synapse#14184)) - Improve validation of request bodies for the [Device Management](https://spec.matrix.org/v1.4/client-server-api/#device-management) and [MSC2697 Device Dehyrdation](matrix-org/matrix-spec-proposals#2697) client-server API endpoints. ([\#14054](matrix-org/synapse#14054)) - Experimental support for [MSC3874](matrix-org/matrix-spec-proposals#3874): Filtering threads from the `/messages` endpoint. ([\#14148](matrix-org/synapse#14148)) - Improve the validation of the following PUT endpoints: [`/directory/room/{roomAlias}`](https://spec.matrix.org/v1.4/client-server-api/#put_matrixclientv3directoryroomroomalias), [`/directory/list/room/{roomId}`](https://spec.matrix.org/v1.4/client-server-api/#put_matrixclientv3directorylistroomroomid) and [`/directory/list/appservice/{networkId}/{roomId}`](https://spec.matrix.org/v1.4/application-service-api/#put_matrixclientv3directorylistappservicenetworkidroomid). ([\#14179](matrix-org/synapse#14179)) Deprecations and Removals ------------------------- - Remove the experimental implementation of [MSC3772](matrix-org/matrix-spec-proposals#3772). ([\#14094](matrix-org/synapse#14094)) - Remove the unstable identifier for [MSC3715](matrix-org/matrix-spec-proposals#3715). ([\#14106](matrix-org/synapse#14106), [\#14146](matrix-org/synapse#14146))

…der instead of `access_token` when talking to the application service, as per [MSC2832](matrix-org/matrix-spec-proposals#2832).

Proposal to fix homeserver -> appservice authorization

a345b36

Signed-off-by: Tulir Asokan <tulir@maunium.net>

tulir mentioned this pull request Oct 24, 2020

Insert access token into query parameters for AS requests ruma/ruma#314

Closed

turt2live added kind:maintenance MSC which clarifies/updates existing spec proposal A matrix spec change proposal proposal-in-review labels Oct 24, 2020

tulir mentioned this pull request Nov 17, 2020

Hide homeserver token from aiohttp logs mautrix/telegram#351

Closed

kegsay approved these changes Dec 17, 2020

View reviewed changes

tulir mentioned this pull request Jan 28, 2021

Access token included in log output mautrix/facebook#128

Open

tulir mentioned this pull request May 19, 2021

Application Service URIs not treated as URIs matrix-org/synapse#10012

Closed

turt2live added the needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. label Jun 8, 2021

turt2live force-pushed the old_master branch from e895827 to dca99ee Compare August 30, 2021 22:34

ShadowJonathan approved these changes Sep 10, 2021

View reviewed changes

proposals/2832-appservice-auth-fix.md Outdated Show resolved Hide resolved

proposals/2832-appservice-auth-fix.md Outdated Show resolved Hide resolved

auscompgeek reviewed Sep 23, 2021

View reviewed changes

proposals/2832-appservice-auth-fix.md Outdated Show resolved Hide resolved

turt2live removed the proposal-in-review label May 5, 2022

Half-Shot mentioned this pull request Jun 9, 2022

Application service API authentication requires access_token to be in the query parameters matrix-org/matrix-spec#679

Closed

reivilibre mentioned this pull request Jun 9, 2022

We should redact the Application Service access tokens from DEBUG logging produced by synapse.http.proxyagent matrix-org/synapse#13010

Closed

turt2live reviewed Jun 9, 2022

View reviewed changes

proposals/2832-appservice-auth-fix.md Outdated Show resolved Hide resolved

turt2live added application services and removed needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. labels Jun 9, 2022

Remove query parameter entirely instead of deprecating it

ab408dd

Signed-off-by: Tulir Asokan <tulir@maunium.net>

mscbot added disposition-merge proposed-final-comment-period Currently awaiting signoff of a majority of team members in order to enter the final comment period. labels Jun 9, 2022

Update title

3c41e0e

Co-authored-by: Jonathan de Jong <jonathandejong02@gmail.com>

mscbot added finished-final-comment-period and removed disposition-merge final-comment-period This MSC has entered a final comment period in interest to approval, postpone, or delete in 5 days. labels Jul 17, 2022

turt2live merged commit 3297d37 into matrix-org:old_master Jul 17, 2022

turt2live added spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec and removed finished-final-comment-period labels Jul 17, 2022

turt2live self-assigned this Aug 2, 2022

turt2live added a commit to matrix-org/matrix-spec that referenced this pull request Aug 3, 2022

Use auth header instead of query param for hs->as comms

97b5702

MSC: matrix-org/matrix-spec-proposals#2832

turt2live mentioned this pull request Aug 3, 2022

Use auth header instead of query param for hs->as comms matrix-org/matrix-spec#1200

Merged

turt2live added spec-pr-in-review A proposal which has been PR'd against the spec and is in review and removed spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec labels Aug 3, 2022

turt2live mentioned this pull request Aug 3, 2022

Support Authorization header on appservices turt2live/matrix-bot-sdk#252

Open

turt2live added a commit to matrix-org/matrix-spec that referenced this pull request Aug 4, 2022

Use auth header instead of query param for hs->as comms (#1200)

6dc7b95

* Use auth header instead of query param for hs->as comms MSC: matrix-org/matrix-spec-proposals#2832 * Fix for OpenAPI 2

turt2live added merged A proposal whose PR has merged into the spec! and removed spec-pr-in-review A proposal which has been PR'd against the spec and is in review labels Aug 4, 2022

zecakeh mentioned this pull request Sep 4, 2022

Incorporate Matrix version 1.4 changes ruma/ruma#1278

Closed

54 tasks

clokep mentioned this pull request Sep 30, 2022

Send the appservice access token as a header. matrix-org/synapse#13996

Merged

zecakeh mentioned this pull request Oct 2, 2022

appservice-api: Add support for using the Authorization header ruma/ruma#1325

Merged

johannescpk mentioned this pull request Oct 31, 2022

appservice: Support Authorization header authentication matrix-org/matrix-rust-sdk#1082

Closed

S7evinK mentioned this pull request Oct 2, 2023

Declare support for Matrix 1.4 matrix-org/dendrite#3222

Open

14 tasks

kegsay mentioned this pull request Oct 9, 2023

Specify what matrix version complement is testing matrix-org/complement#335

Open

clokep mentioned this pull request Apr 12, 2024

MSC4127: Removal of query string auth #4127

Open

matrixbot mentioned this pull request Nov 1, 2024

Declare support for Matrix 1.4 element-hq/dendrite#3222

Open

14 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MSC2832: HS -> AS authorization header #2832

MSC2832: HS -> AS authorization header #2832

tulir commented Oct 24, 2020 •

edited

Loading

turt2live commented Jun 9, 2022

turt2live commented Jun 9, 2022

mscbot commented Jun 9, 2022 •

edited by richvdh

Loading

mscbot commented Jul 17, 2022

turt2live commented Aug 3, 2022

turt2live commented Aug 4, 2022

MSC2832: HS -> AS authorization header #2832

MSC2832: HS -> AS authorization header #2832

Conversation

tulir commented Oct 24, 2020 • edited Loading

turt2live commented Jun 9, 2022

turt2live commented Jun 9, 2022

mscbot commented Jun 9, 2022 • edited by richvdh Loading

mscbot commented Jul 17, 2022

turt2live commented Aug 3, 2022

turt2live commented Aug 4, 2022

tulir commented Oct 24, 2020 •

edited

Loading

mscbot commented Jun 9, 2022 •

edited by richvdh

Loading