Devon HudsonandClaude Opus 5.5
e6d64744bb
`POST /register` checks that a registration matches the username and email address its token pins, but the token step could attach any valid token to a registration afterwards. Registering as anyone, then attaching a pinned token, registered a username the token doesn't pin. Swapping a passwordless token for one that isn't left a registration with no password at all. The token step now refuses a token that doesn't fit the registration: one that pins another username or another email address than the registration's, or one that isn't passwordless for a registration without a password or an upstream link. Finishing a registration checks the same against the verified email address, and refuses a passwordless registration without one. Only a tampered registration gets that far, so these fail like the other last-minute checks there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZdGaj9bJcn5QeeUw8YXoF
Matrix Authentication Service
MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. You can directly run and manage the source code in this repository, available under an AGPL license (or alternatively under a commercial license from Element). Support is not provided by Element unless you have a subscription.
It has been created to support the migration of Matrix to a next-generation of auth APIs per MSC3861.
See the Documentation for information on installation and use.
You can learn more about Matrix and next-generation auth at areweoidcyet.com.
🚀 Getting started
This component is developed and maintained by Element. It gets shipped as part of the Element Server Suite (ESS) which provides the official means of deployment.
ESS is a Matrix distribution from Element with focus on quality and ease of use. It ships a full Matrix stack tailored to the respective use case.
There are three editions of ESS:
- ESS Community - the free Matrix distribution from Element tailored to small-/mid-scale, non-commercial community use cases
- ESS Pro - the commercial Matrix distribution from Element for professional use
- ESS TI-M - a special version of ESS Pro focused on the requirements of TI-Messenger Pro and ePA as specified by the German National Digital Health Agency Gematik
💬 Community room
Developers and users of Matrix Authentication Service can chat in the #matrix-auth:matrix.org room on Matrix.
🛠️ Standalone installation and configuration
The best way to get a modern Element Matrix stack is through the Element Server Suite, which includes MAS.
The MAS documentation describes how to install and configure MAS. We recommend using the Docker image or the pre-built binaries.
📖 Translations
Matrix Authentication Service is available in multiple languages. Anyone can contribute to translations through Localazy.
🏗️ Contributing
See the contribution guidelines for information on how to contribute to this project.
⚖️ Copyright & License
Copyright 2021-2024 The Matrix.org Foundation C.I.C.
Copyright 2024, 2025 New Vector Ltd.
Copyright 2025, 2026 Element Creations Ltd.
This software is dual-licensed by Element Creations Ltd (Element). It can be used either:
(1) for free under the terms of the GNU Affero General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
(2) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to). Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.