dandri/matrix-authentication-service
1
0 Fork 0
mirror of https://github.com/element-hq/matrix-authentication-service.git synced 2026-10-23 21:46:14 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,960 Commits 90 Branches 115 Tags
2d5710d69e445dccfa5f8d377622c53a8cf69b39
Commit Graph
6960 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Eric Eastwood 2d5710d69e Merge branch 'main' into madlittlemods/session-soft-limit-for-interactive-contexts 2026-04-28 13:58:33 -05:00
Olivier 'reivilibre 6a99e56c8b Overwrite the URL fragment when redirecting to clients using query callback mode. (#5653) 
Without this fix, it's possible for the fragment part of the URI coming from the upstream OAuth provider to be forwarded on to the downstream client's redirect URI.

Facebook sets `#_=_` for security (they essentially clear the fragment in the same way this PR does, except they use this dummy value instead of emptying it) and when Element Web (prior to https://github.com/element-hq/element-web/pull/33100) receives this, it would sit with an infini-spinner (https://github.com/element-hq/element-web/issues/33096).

Although Element Web is now fixed, it's not unreasonable for us to strip this (there is potentially a light security angle to it, although mostly it's just not good form to forward junk on to the downstream client).

This PR:
- sets the fragment to `#` (i.e. empty string after the hash) in an effort to erase the current fragment
- unless the `redirect_uri` already includes a fragment, in which case we preserve it (as that will also overwrite the browser's current fragment)

The PR also introduces a characterisation test to show the before and after behaviour.
In a commit-by-commit review, the characterisation test passes before the actual change this PR introduces.

---

As noted on the issue, the 'fragment preserving' and 'fragment overwriting' behaviour is described in the WHATWG fetch spec:

> The location URL of a [response](https://fetch.spec.whatwg.org/#concept-response) response, given null or an [ASCII string](https://infra.spec.whatwg.org/#ascii-string) requestFragment, is the value returned by the following steps. They return null, failure, or a [URL](https://url.spec.whatwg.org/#concept-url).
> 
> 1.  If response’s [status](https://fetch.spec.whatwg.org/#concept-response-status) is not a [redirect status](https://fetch.spec.whatwg.org/#redirect-status), then return null.
> 2.  Let location be the result of [extracting header list values](https://fetch.spec.whatwg.org/#extract-header-list-values) given \``Location`\` and response’s [header list](https://fetch.spec.whatwg.org/#concept-response-header-list).
> 3.  If location is a [header value](https://fetch.spec.whatwg.org/#header-value), then set location to the result of [parsing](https://url.spec.whatwg.org/#concept-url-parser) location with response’s [URL](https://fetch.spec.whatwg.org/#concept-response-url).
>     
>     If response was constructed through the `[Response](https://fetch.spec.whatwg.org/#response)` constructor, response’s [URL](https://fetch.spec.whatwg.org/#concept-response-url) will be null, meaning that location will only parse successfully if it is an [absolute-URL-with-fragment string](https://url.spec.whatwg.org/#absolute-url-with-fragment-string).
>     
> 4.  **If location is a [URL](https://url.spec.whatwg.org/#concept-url) whose [fragment](https://url.spec.whatwg.org/#concept-url-fragment) is null, then set location’s [fragment](https://url.spec.whatwg.org/#concept-url-fragment) to requestFragment.**
>     
>     This ensures that synthetic (indeed, all) responses follow the processing model for redirects defined by HTTP. [\[HTTP\]](https://fetch.spec.whatwg.org/#biblio-http "HTTP Semantics")
>     
> 5.  Return location.
> 
> The [location URL](https://fetch.spec.whatwg.org/#concept-response-location-url) algorithm is exclusively used for redirect handling in this standard and in HTML’s navigate algorithm which handles redirects manually. [\[HTML\]](https://fetch.spec.whatwg.org/#biblio-html "HTML Standard")
> 
> — https://fetch.spec.whatwg.org/#concept-response-location-url [[snapshotted]](https://fetch.spec.whatwg.org/commit-snapshots/809904366f33a673a9489b81155ee9e3edd29c12/#concept-response-location-url)

I believe this is then invoked in https://html.spec.whatwg.org/#populating-a-session-history-entry (dig from the HTML navigate algorithm)
 2026-04-27 17:20:50 +00:00
Olivier 'reivilibre 76865b239a Simplify comment and test 2026-04-24 13:40:03 +01:00
Olivier 'reivilibre 1d428b0624 build(deps): bump rustls-webpki from 0.103.10 to 0.103.13 (#5650) 2026-04-23 16:32:09 +00:00
Olivier 'reivilibre f50d2e53cd Overwrite the fragment with # on query callback mode 2026-04-23 15:23:54 +01:00
Olivier 'reivilibre 29f7d986ee Add characterisation test 2026-04-23 15:21:35 +01:00
dependabot[bot] 8787fbb459 build(deps): bump rustls-webpki from 0.103.10 to 0.103.13 
Bumps [rustls-webpki](https://github.com/rustls/webpki) from 0.103.10 to 0.103.13.
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](https://github.com/rustls/webpki/compare/v/0.103.10...v/0.103.13)

---
updated-dependencies:
- dependency-name: rustls-webpki
  dependency-version: 0.103.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-23 01:20:28 +00:00
Eric Eastwood beac162d8b Run automatic updates and lints 
From https://github.com/element-hq/matrix-authentication-service/blob/main/docs/development/contributing.md#7-test-test-test
 2026-04-17 15:59:46 -05:00
Eric Eastwood 2623d35363 Revert manual login docs that were split out to #5642 
Split out to https://github.com/element-hq/matrix-authentication-service/pull/5642
 2026-04-17 15:57:05 -05:00
Eric Eastwood 7d2706c0d5 Display Device limit reached error on policy violation screen 2026-04-17 15:17:43 -05:00
Eric Eastwood 5b2376074a Expose violations on the PolicyViolationContext 
Basically the same as https://github.com/element-hq/matrix-authentication-service/commit/73e3b0bda320909682dddcc541e0eea056cbea47
after working through it myself
 2026-04-17 14:20:47 -05:00
Eric Eastwood 3a371b4c62 m.login.token is part of m.login.sso (comment in policy) 
No need to mention it
 2026-04-16 15:07:32 -05:00
Eric Eastwood 2db97009c5 'manually' typo 2026-04-14 19:34:30 -05:00
Eric Eastwood 528b3bc500 Fix html -> md suffix 2026-04-14 19:28:24 -05:00
Eric Eastwood f4132fb3c9 Remove extra words 2026-04-14 19:27:36 -05:00
Eric Eastwood ef52f5bebb Better reading 2026-04-14 19:26:49 -05:00
Eric Eastwood ca27583f44 Better language and fix typos 2026-04-14 19:24:44 -05:00
Eric Eastwood 260ad7abd1 m.login.token is part of m.login.sso 
No need to mention it
 2026-04-14 19:23:57 -05:00
Eric Eastwood ecb05d2039 Fill in authorization code grant flow 2026-04-14 19:16:36 -05:00
Eric Eastwood bf45bf8ce0 Better docs on m.login.sso compat flow 2026-04-14 16:00:18 -05:00
Eric Eastwood 73085e0c95 Update docs as I understand interactive vs non-interactive better 2026-04-14 15:07:00 -05:00
matrixbot 64f90e01da Automatic merge back to main (#5634) 2026-04-14 14:33:56 +02:00
github-actions[bot] ba306d4bcb 1.16.0-rc.0 v1.16.0-rc.0 2026-04-14 12:23:53 +00:00
matrixbot 969200b9f1 Translations updates for main (#5632) 2026-04-14 14:11:36 +02:00
github-actions[bot] f246792965 Translations updates 2026-04-14 12:03:04 +00:00
Eric Eastwood bc1e71baa3 Merge branch 'main' into madlittlemods/hard_limit_eviction 2026-04-13 17:00:02 -05:00
Quentin Gliech 4b1f54f9de Upgrade opa-wasm and wasmtime to close a few advisories (#5630) 2026-04-13 23:59:16 +02:00
Eric Eastwood 12ce01fed9 Explicitly mention that it doesn't matter for this test 2026-04-13 16:43:14 -05:00
Eric Eastwood 5162529b16 Fix flaky recent eviction test 2026-04-13 16:38:45 -05:00
Eric Eastwood d53ab882bf Wait for last_active_at to be set 
See https://github.com/element-hq/matrix-authentication-service/pull/5607#discussion_r3061734830
 2026-04-13 15:57:26 -05:00
Eric Eastwood e4b8a3659f Fix validate error not extra metadata 
New error example:
```
Error: Session `hard_limit` must be at-least 2 when automatic `hard_limit_eviction` is set. See configuration docs for more info. for key "default.experimental.session_limit.hard_limit" in config.yaml YAML file
```

See:

 - https://github.com/element-hq/matrix-authentication-service/pull/5607#discussion_r3034406794
 - https://github.com/element-hq/matrix-authentication-service/pull/5607#discussion_r3057732795
 2026-04-13 15:41:18 -05:00
Eric Eastwood 1ff9d288d8 Allow clippy uninlined_format_args 
See https://github.com/element-hq/matrix-authentication-service/pull/5607#discussion_r3075627261
 2026-04-13 15:31:57 -05:00
Eric Eastwood 020fb58125 Remove uninlined_format_args usage 
Fix https://github.com/element-hq/matrix-authentication-service/pull/5607#discussion_r3047833269
 2026-04-13 15:26:09 -05:00
Quentin Gliech aefe87e87f Update skip list in deny.toml 
We should eventually update more crates to get versions aligned, as well
as plan a rand 0.10 upgrade, but this isn't a priority right now.
 2026-04-13 18:24:08 +02:00
Quentin Gliech cfe3b70404 Upgrade rand to 0.9.4 
See https://rustsec.org/advisories/RUSTSEC-2026-0097
 2026-04-13 18:12:04 +02:00
Quentin Gliech 808f63571b Upgrade opa-wasm to 0.2.0 to upgrade wasmtime 
This fixes a bunch of RUSTSEC advisories, see https://github.com/element-hq/matrix-authentication-service/issues/5621
 2026-04-13 18:10:19 +02:00
Eric Eastwood de366d577f Run cargo +nightly fmt 2026-04-10 16:24:15 -05:00
Eric Eastwood b0c1a04585 Merge branch 'main' into madlittlemods/hard_limit_eviction 2026-04-10 16:23:11 -05:00
Eric Eastwood eb813cbe49 Fix spacing typo 2026-04-10 16:19:22 -05:00
Eric Eastwood b1cb96dd83 Lint/format policies 
- `make DOCKER=1 fmt`
 - `make DOCKER=1 lint`
 2026-04-10 16:02:00 -05:00
Eric Eastwood d9135d5696 Prefer variable shadowing (need_to_remove) 
See https://github.com/element-hq/matrix-authentication-service/pull/5607#discussion_r3058106230
 2026-04-10 15:56:47 -05:00
Eric Eastwood d377011282 Grab need_to_remove from violation 
As planned in https://github.com/element-hq/matrix-authentication-service/pull/5553
 2026-04-10 15:55:38 -05:00
Eric Eastwood d8b0e877f4 Better test description 2026-04-10 15:22:48 -05:00
Eric Eastwood 21566b769d Add some docs for debugging policies (#5620) 2026-04-10 15:19:24 -05:00
Eric Eastwood 25efb0cc4e Merge branch 'main' into madlittlemods/debug-policy-data 2026-04-10 14:56:48 -05:00
Olivier 'reivilibre 2105226034 build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 (#5624) 2026-04-10 17:08:00 +00:00
Olivier 'reivilibre cac4a9ca4c build(deps): bump EmbarkStudios/cargo-deny-action from 2.0.15 to 2.0.16 (#5623) 2026-04-10 17:07:42 +00:00
Eric Eastwood ccf139f127 Merge branch 'main' into madlittlemods/hard_limit_eviction 2026-04-10 10:03:55 -05:00
dependabot[bot] a804d3ecb7 build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v7.0.0...v7.1.0)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-10 13:54:10 +00:00
dependabot[bot] 671a676dfd build(deps): bump EmbarkStudios/cargo-deny-action from 2.0.15 to 2.0.16 
Bumps [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) from 2.0.15 to 2.0.16.
- [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases)
- [Commits](https://github.com/embarkstudios/cargo-deny-action/compare/v2.0.15...v2.0.16)

---
updated-dependencies:
- dependency-name: EmbarkStudios/cargo-deny-action
  dependency-version: 2.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-10 13:54:03 +00:00