wholetrans/docs-matrix-spec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Clarify how homeservers are meant to auth themselves to appservices

Browse source 
Fixes https://github.com/matrix-org/matrix-doc/issues/1765

Note that the swagger definitions already say that authorization is required. It just wasn't mentioned in the spec.
This commit is contained in:
Travis Ralston 2019-05-27 22:40:07 -06:00
parent 699cafe670
commit d0fd20fdb4
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelogs/application_service/newsfragments/2037.clarification Normal file
View file

@ -0,0 +1 @@
Add missing definition for how appservices verify requests came from a homeserver.

8
specification/application_service_api.rst
View file

@ -187,6 +187,14 @@ An example registration file for an IRC-bridging application service is below:
Homeserver -> Application Service API
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Authorization
+++++++++++++
Homeservers MUST include a query parameter named ``access_token`` containing the
``hs_token`` from the application service's registration when making requests to
the application service. Application services MUST verify the provided ``access_token``
matches their known ``hs_token``, failing the request with a ``M_FORBIDDEN`` error.
Legacy routes
+++++++++++++