wholetrans/docs-matrix-spec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Clarify that UIA stages cannot be attempted twice

Browse source 
Fixes https://github.com/matrix-org/matrix-doc/issues/1987

Note: Synapse currently does not care, however the spirit of the text in the spec implies that completed == done forever, so we're just reinforcing it here.
This commit is contained in:
Travis Ralston 2019-05-29 18:35:18 -06:00
parent d2232aca97
commit 0f623113f1
2 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelogs/client_server/newsfragments/2054.clarification Normal file
View file

@ -0,0 +1 @@
Clarify that User-Interactive Authentication stages cannot be attempted more than once.

11
specification/client_server_api.rst
View file

@ -453,11 +453,10 @@ params
presented, that type may be present as a key in this dictionary. For example, presented, that type may be present as a key in this dictionary. For example,
the public part of an OAuth client ID could be given here. the public part of an OAuth client ID could be given here.
session session
This is a session identifier that the client must pass back to the home This is a session identifier that the client must pass back to the homeserver,
server, if one is provided, in subsequent attempts to authenticate in the same if one is provided, in subsequent attempts to authenticate in the same API call.
API call.
The client then chooses a flow and attempts to complete one of the stages. It The client then chooses a flow and attempts to complete the first stage. It
does this by resubmitting the same request with the addition of an ``auth`` does this by resubmitting the same request with the addition of an ``auth``
key in the object that it submits. This dictionary contains a ``type`` key whose key in the object that it submits. This dictionary contains a ``type`` key whose
value is the name of the authentication type that the client is attempting to complete. value is the name of the authentication type that the client is attempting to complete.
@ -558,7 +557,9 @@ message in the standard format. For example:
} }
If the client has completed all stages of a flow, the homeserver performs the If the client has completed all stages of a flow, the homeserver performs the
API call and returns the result as normal. API call and returns the result as normal. Completed stages cannot be re-tried;
The client must abandon the current session and start over. Homeservers should
treat retries as authentication errors.
Some authentication types may be completed by means other than through the Some authentication types may be completed by means other than through the
Matrix client, for example, an email confirmation may be completed when the user Matrix client, for example, an email confirmation may be completed when the user