mirror of
https://github.com/element-hq/matrix-authentication-service.git
synced 2026-10-12 13:38:21 +00:00
Devon HudsonandClaude Opus 5.5
e6d64744bb
`POST /register` checks that a registration matches the username and email address its token pins, but the token step could attach any valid token to a registration afterwards. Registering as anyone, then attaching a pinned token, registered a username the token doesn't pin. Swapping a passwordless token for one that isn't left a registration with no password at all. The token step now refuses a token that doesn't fit the registration: one that pins another username or another email address than the registration's, or one that isn't passwordless for a registration without a password or an upstream link. Finishing a registration checks the same against the verified email address, and refuses a passwordless registration without one. Only a tampered registration gets that far, so these fail like the other last-minute checks there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZdGaj9bJcn5QeeUw8YXoF