kgess-mirror/matrix-spec
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-spec.git synced 2026-01-11 19:46:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Specify that the /openid/userinfo return value must be validated (#2288)

Browse source
This commit is contained in:
Tulir Asokan 2026-01-06 19:23:19 +02:00 • committed by GitHub
parent f2b68c7163
commit 43c65786eb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelogs/server_server/newsfragments/2288.clarification Normal file
View file

@ -0,0 +1 @@
Specify that callers of `/_matrix/federation/v1/openid/userinfo` must validate the returned user ID.

7
data/api/server-server/openid.yaml
View file

@ -43,7 +43,12 @@ paths:
properties:
sub:
type: string
description: The Matrix User ID who generated the token.
description: |
The Matrix User ID who generated the token.
The caller MUST validate that the returned user ID is on the server they
called (i.e. if you make a request to example.com and it returns
`@alice:matrix.org`, the result is invalid).
example: "@alice:example.com"
required:
- sub