wholetrans/docs-matrix-spec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Reword "UI Authorization" to "User-Interactive Authentication" (#2667)

Browse source 
Signed-off-by: Aaron Raimist <aaron@raim.ist>
This commit is contained in:
Aaron Raimist 2020-07-06 05:19:41 -05:00 • committed by GitHub
parent a91c6446bc
commit f8ff2ad6a9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
api/client-server/logout.yaml
View file

@ -54,11 +54,12 @@ paths:
for the user are also deleted. `Device keys <#device-keys>`_ for the device are for the user are also deleted. `Device keys <#device-keys>`_ for the device are
deleted alongside the device. deleted alongside the device.
This endpoint does not require UI authorization because UI authorization is This endpoint does not use the `User-Interactive Authentication API`_ because
designed to protect against attacks where the someone gets hold of a single access User-Interactive Authentication is designed to protect against attacks where the
token then takes over the account. This endpoint invalidates all access tokens for someone gets hold of a single access token then takes over the account. This
the user, including the token used in the request, and therefore the attacker is endpoint invalidates all access tokens for the user, including the token used in
unable to take over the account in this way. the request, and therefore the attacker is unable to take over the account in
this way.
operationId: logout_all operationId: logout_all
security: security:
- accessToken: [] - accessToken: []

1
changelogs/client_server/2667.clarification Normal file
View file

@ -0,0 +1 @@
Reword "UI Authorization" to "User-Interactive Authentication" to be more clear.

3
specification/client_server_api.rst
View file

@ -1090,8 +1090,7 @@ Login
A client can obtain access tokens using the ``/login`` API. A client can obtain access tokens using the ``/login`` API.
Note that this endpoint does `not` currently use the user-interactive Note that this endpoint does `not` currently use the `User-Interactive Authentication API`_.
authentication API.
For a simple username/password login, clients should submit a ``/login`` For a simple username/password login, clients should submit a ``/login``
request as follows: request as follows: