kgess-mirror/element-web
1
0
Fork 0
mirror of https://github.com/element-hq/element-web.git synced 2026-01-16 23:01:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 17

Do not send empty auth when setting up cross-signing keys (#29914)

Browse source 
* Do not send empty auth when setting up cross-signing keys

My understanding from the spec is that no auth parameter should be sent
when starting a UIA flow. [This section](https://spec.matrix.org/v1.14/client-server-api/#user-interactive-api-in-the-rest-api)
says that "A client should first make a request with no auth parameter"
and this is not what element-web is doing (since it is sending an auth parameter with
an empty dictionary).

In the upload cross-signing keys endpoint
[documentation](https://spec.matrix.org/v1.14/client-server-api/#post_matrixclientv3keysdevice_signingupload_request_authentication-data)
it says that type may be omitted if session is set, but in this specific
case neither of the fields is set.

* fixup! Do not send empty auth when setting up cross-signing keys
This commit is contained in:
gnieto 2025-06-10 13:37:04 +02:00 • committed by GitHub
parent e7d940160a
commit 16773f5e4a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/CreateCrossSigning.ts
View file

@ -38,10 +38,10 @@ export async function createCrossSigning(cli: MatrixClient): Promise<void> {
export async function uiAuthCallback(
matrixClient: MatrixClient,
makeRequest: (authData: AuthDict) => Promise<void>,
makeRequest: (authData: AuthDict | null) => Promise<void>,
): Promise<void> {
try {
await makeRequest({});
await makeRequest(null);
} catch (error) {
if (!(error instanceof MatrixError) || !error.data || !error.data.flows) {
// Not a UIA response

2
test/CreateCrossSigning-test.ts
View file

@ -45,7 +45,7 @@ describe("CreateCrossSigning", () => {
const makeRequest = jest.fn();
await authUploadDeviceSigningKeys!(makeRequest);
expect(makeRequest).toHaveBeenCalledWith({});
expect(makeRequest).toHaveBeenCalledWith(null);
});
it("should prompt user if upload failed with UIA", async () => {