deploy: 20fc9fcc33

develop/print.html

@@ -5445,6 +5445,31 @@ into fewer transactions. Defaults to 50.</p>
 unauthenticated media endpoints (<code>/_matrix/media/(r0|v3|v1)/download</code> and <code>/_matrix/media/(r0|v3|v1)/thumbnail</code>) - requests for authenticated media over these endpoints will result in a 404. All media, including authenticated media, will be available over the authenticated media endpoints <code>_matrix/client/v1/media/download</code> and <code>_matrix/client/v1/media/thumbnail</code>. Media uploaded prior to setting this option to true will still be available over the legacy endpoints. Note if the setting is switched to false
 after enabling, media marked as authenticated will be available over legacy endpoints. Defaults to false, but
 this will change to true in a future Synapse release.</p>
+<p>In all cases, authenticated requests to download media will succeed, but for unauthenticated requests, this
+case-by-case breakdown describes whether media downloads are permitted:</p>
+<ul>
+<li><code>enable_authenticated_media = False</code>:
+<ul>
+<li>unauthenticated client or homeserver requesting local media: allowed</li>
+<li>unauthenticated client or homeserver requesting remote media: allowed as long as the media is in the cache,
+or as long as the remote homeserver does not require authentication to retrieve the media</li>
+</ul>
+</li>
+<li><code>enable_authenticated_media = True</code>:
+<ul>
+<li>unauthenticated client or homeserver requesting local media:
+allowed if the media was stored on the server whilst <code>enable_authenticated_media</code> was <code>False</code> (or in a previous Synapse version where this option did not exist);
+otherwise denied.</li>
+<li>unauthenticated client or homeserver requesting remote media: the same as for local media;
+allowed if the media was stored on the server whilst <code>enable_authenticated_media</code> was <code>False</code> (or in a previous Synapse version where this option did not exist);
+otherwise denied.</li>
+</ul>
+</li>
+</ul>
+<p>It is especially notable that media downloaded before this option existed (in older Synapse versions), or whilst this option was set to <code>False</code>,
+will perpetually be available over the legacy, unauthenticated endpoint, even after this option is set to <code>True</code>.
+This is for backwards compatibility with older clients and homeservers that do not yet support requesting authenticated media;
+those older clients or homeservers will not be cut off from media they can already see.</p>
 <p>Example configuration:</p>
 <pre><code class="language-yaml">enable_authenticated_media: true
 </code></pre>

develop/searchindex.js

@@ -1 +1 @@
-Object.assign(window.search, {"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","setup/turn/coturn.html#coturn-turn-server","setup/turn/coturn.html#coturn-setup","setup/turn/coturn.html#initial-installation","setup/turn/coturn.html#configuration","setup/turn/eturnal.html#eturnal-turn-server","setup/turn/eturnal.html#eturnal-setup","setup/turn/eturnal.html#initial-installation","setup/turn/eturnal.html#configuration","setup/turn/eturnal.html#eturnalctl-opterations-script","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-from-a-very-old-version","upgrade.html#upgrading-to-v11190","upgrade.html#minimum-supported-python-version","upgrade.html#upgrading-to-v11110","upgrade.html#new-worker-endpoints-for-authenticated-client-and-federation-media","upgrade.html#upgrading-to-v11060","upgrade.html#minimum-supported-rust-version","upgrade.html#upgrading-to-v11000","upgrade.html#minimum-supported-rust-version-1","upgrade.html#upgrading-to-v1930","upgrade.html#minimum-supported-rust-version-2","upgrade.html#upgrading-to-v1900","upgrade.html#app-service-query-parameter-authorization-is-now-a-configuration-option","upgrade.html#upgrading-to-v1890","upgrade.html#removal-of-unspecced-user-property-for-register","upgrade.html#upgrading-to-v1880","upgrade.html#minimum-supported-python-version-1","upgrade.html#removal-of-worker_replication_-settings","upgrade.html#upgrading-to-v1860","upgrade.html#minimum-supported-rust-version-3","upgrade.html#upgrading-to-v1850","upgrade.html#application-service-registration-with-user-property-deprecation","upgrade.html#upgrading-to-v1840","upgrade.html#deprecation-of-worker_replication_-configuration-settings","upgrade.html#example-change","upgrade.html#upgrading-to-v1810","upgrade.html#application-service-path--authentication-deprecations","upgrade.html#upgrading-to-v1800","upgrade.html#reporting-events-error-code-change","upgrade.html#upgrading-to-v1790","upgrade.html#the-on_threepid_bind-module-callback-method-has-been-deprecated","upgrade.html#upgrading-to-v1780","upgrade.html#deprecate-the-_synapseadminv1mediadelete-admin-api","upgrade.html#upgrading-to-v1760","upgrade.html#faster-joins-are-enabled-by-default","upgrade.html#changes-to-the-account-data-replication-streams","upgrade.html#minimum-version-of-poetry-is-now-132","upgrade.html#upgrading-to-v1740","upgrade.html#unicode-support-in-user-search","upgrade.html#user-directory-rebuild","upgrade.html#upgrading-to-v1730","upgrade.html#legacy-prometheus-metric-names-have-now-been-removed","upgrade.html#upgrading-to-v1720","upgrade.html#dropping-support-for-postgresql-10","upgrade.html#upgrading-to-v1710","upgLine truncated
+Object.assign(window.search, {"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","setup/turn/coturn.html#coturn-turn-server","setup/turn/coturn.html#coturn-setup","setup/turn/coturn.html#initial-installation","setup/turn/coturn.html#configuration","setup/turn/eturnal.html#eturnal-turn-server","setup/turn/eturnal.html#eturnal-setup","setup/turn/eturnal.html#initial-installation","setup/turn/eturnal.html#configuration","setup/turn/eturnal.html#eturnalctl-opterations-script","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-from-a-very-old-version","upgrade.html#upgrading-to-v11190","upgrade.html#minimum-supported-python-version","upgrade.html#upgrading-to-v11110","upgrade.html#new-worker-endpoints-for-authenticated-client-and-federation-media","upgrade.html#upgrading-to-v11060","upgrade.html#minimum-supported-rust-version","upgrade.html#upgrading-to-v11000","upgrade.html#minimum-supported-rust-version-1","upgrade.html#upgrading-to-v1930","upgrade.html#minimum-supported-rust-version-2","upgrade.html#upgrading-to-v1900","upgrade.html#app-service-query-parameter-authorization-is-now-a-configuration-option","upgrade.html#upgrading-to-v1890","upgrade.html#removal-of-unspecced-user-property-for-register","upgrade.html#upgrading-to-v1880","upgrade.html#minimum-supported-python-version-1","upgrade.html#removal-of-worker_replication_-settings","upgrade.html#upgrading-to-v1860","upgrade.html#minimum-supported-rust-version-3","upgrade.html#upgrading-to-v1850","upgrade.html#application-service-registration-with-user-property-deprecation","upgrade.html#upgrading-to-v1840","upgrade.html#deprecation-of-worker_replication_-configuration-settings","upgrade.html#example-change","upgrade.html#upgrading-to-v1810","upgrade.html#application-service-path--authentication-deprecations","upgrade.html#upgrading-to-v1800","upgrade.html#reporting-events-error-code-change","upgrade.html#upgrading-to-v1790","upgrade.html#the-on_threepid_bind-module-callback-method-has-been-deprecated","upgrade.html#upgrading-to-v1780","upgrade.html#deprecate-the-_synapseadminv1mediadelete-admin-api","upgrade.html#upgrading-to-v1760","upgrade.html#faster-joins-are-enabled-by-default","upgrade.html#changes-to-the-account-data-replication-streams","upgrade.html#minimum-version-of-poetry-is-now-132","upgrade.html#upgrading-to-v1740","upgrade.html#unicode-support-in-user-search","upgrade.html#user-directory-rebuild","upgrade.html#upgrading-to-v1730","upgrade.html#legacy-prometheus-metric-names-have-now-been-removed","upgrade.html#upgrading-to-v1720","upgrade.html#dropping-support-for-postgresql-10","upgrade.html#upgrading-to-v1710","upgLine truncated

develop/searchindex.json

@@ -1 +1 @@
-{"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","setup/turn/coturn.html#coturn-turn-server","setup/turn/coturn.html#coturn-setup","setup/turn/coturn.html#initial-installation","setup/turn/coturn.html#configuration","setup/turn/eturnal.html#eturnal-turn-server","setup/turn/eturnal.html#eturnal-setup","setup/turn/eturnal.html#initial-installation","setup/turn/eturnal.html#configuration","setup/turn/eturnal.html#eturnalctl-opterations-script","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-from-a-very-old-version","upgrade.html#upgrading-to-v11190","upgrade.html#minimum-supported-python-version","upgrade.html#upgrading-to-v11110","upgrade.html#new-worker-endpoints-for-authenticated-client-and-federation-media","upgrade.html#upgrading-to-v11060","upgrade.html#minimum-supported-rust-version","upgrade.html#upgrading-to-v11000","upgrade.html#minimum-supported-rust-version-1","upgrade.html#upgrading-to-v1930","upgrade.html#minimum-supported-rust-version-2","upgrade.html#upgrading-to-v1900","upgrade.html#app-service-query-parameter-authorization-is-now-a-configuration-option","upgrade.html#upgrading-to-v1890","upgrade.html#removal-of-unspecced-user-property-for-register","upgrade.html#upgrading-to-v1880","upgrade.html#minimum-supported-python-version-1","upgrade.html#removal-of-worker_replication_-settings","upgrade.html#upgrading-to-v1860","upgrade.html#minimum-supported-rust-version-3","upgrade.html#upgrading-to-v1850","upgrade.html#application-service-registration-with-user-property-deprecation","upgrade.html#upgrading-to-v1840","upgrade.html#deprecation-of-worker_replication_-configuration-settings","upgrade.html#example-change","upgrade.html#upgrading-to-v1810","upgrade.html#application-service-path--authentication-deprecations","upgrade.html#upgrading-to-v1800","upgrade.html#reporting-events-error-code-change","upgrade.html#upgrading-to-v1790","upgrade.html#the-on_threepid_bind-module-callback-method-has-been-deprecated","upgrade.html#upgrading-to-v1780","upgrade.html#deprecate-the-_synapseadminv1mediadelete-admin-api","upgrade.html#upgrading-to-v1760","upgrade.html#faster-joins-are-enabled-by-default","upgrade.html#changes-to-the-account-data-replication-streams","upgrade.html#minimum-version-of-poetry-is-now-132","upgrade.html#upgrading-to-v1740","upgrade.html#unicode-support-in-user-search","upgrade.html#user-directory-rebuild","upgrade.html#upgrading-to-v1730","upgrade.html#legacy-prometheus-metric-names-have-now-been-removed","upgrade.html#upgrading-to-v1720","upgrade.html#dropping-support-for-postgresql-10","upgrade.html#upgrading-to-v1710","upgrade.html#removal-of-the-geneLine truncated
+{"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","setup/turn/coturn.html#coturn-turn-server","setup/turn/coturn.html#coturn-setup","setup/turn/coturn.html#initial-installation","setup/turn/coturn.html#configuration","setup/turn/eturnal.html#eturnal-turn-server","setup/turn/eturnal.html#eturnal-setup","setup/turn/eturnal.html#initial-installation","setup/turn/eturnal.html#configuration","setup/turn/eturnal.html#eturnalctl-opterations-script","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-from-a-very-old-version","upgrade.html#upgrading-to-v11190","upgrade.html#minimum-supported-python-version","upgrade.html#upgrading-to-v11110","upgrade.html#new-worker-endpoints-for-authenticated-client-and-federation-media","upgrade.html#upgrading-to-v11060","upgrade.html#minimum-supported-rust-version","upgrade.html#upgrading-to-v11000","upgrade.html#minimum-supported-rust-version-1","upgrade.html#upgrading-to-v1930","upgrade.html#minimum-supported-rust-version-2","upgrade.html#upgrading-to-v1900","upgrade.html#app-service-query-parameter-authorization-is-now-a-configuration-option","upgrade.html#upgrading-to-v1890","upgrade.html#removal-of-unspecced-user-property-for-register","upgrade.html#upgrading-to-v1880","upgrade.html#minimum-supported-python-version-1","upgrade.html#removal-of-worker_replication_-settings","upgrade.html#upgrading-to-v1860","upgrade.html#minimum-supported-rust-version-3","upgrade.html#upgrading-to-v1850","upgrade.html#application-service-registration-with-user-property-deprecation","upgrade.html#upgrading-to-v1840","upgrade.html#deprecation-of-worker_replication_-configuration-settings","upgrade.html#example-change","upgrade.html#upgrading-to-v1810","upgrade.html#application-service-path--authentication-deprecations","upgrade.html#upgrading-to-v1800","upgrade.html#reporting-events-error-code-change","upgrade.html#upgrading-to-v1790","upgrade.html#the-on_threepid_bind-module-callback-method-has-been-deprecated","upgrade.html#upgrading-to-v1780","upgrade.html#deprecate-the-_synapseadminv1mediadelete-admin-api","upgrade.html#upgrading-to-v1760","upgrade.html#faster-joins-are-enabled-by-default","upgrade.html#changes-to-the-account-data-replication-streams","upgrade.html#minimum-version-of-poetry-is-now-132","upgrade.html#upgrading-to-v1740","upgrade.html#unicode-support-in-user-search","upgrade.html#user-directory-rebuild","upgrade.html#upgrading-to-v1730","upgrade.html#legacy-prometheus-metric-names-have-now-been-removed","upgrade.html#upgrading-to-v1720","upgrade.html#dropping-support-for-postgresql-10","upgrade.html#upgrading-to-v1710","upgrade.html#removal-of-the-geneLine truncated

develop/usage/configuration/config_documentation.html

@@ -1780,6 +1780,31 @@ into fewer transactions. Defaults to 50.</p>
 unauthenticated media endpoints (<code>/_matrix/media/(r0|v3|v1)/download</code> and <code>/_matrix/media/(r0|v3|v1)/thumbnail</code>) - requests for authenticated media over these endpoints will result in a 404. All media, including authenticated media, will be available over the authenticated media endpoints <code>_matrix/client/v1/media/download</code> and <code>_matrix/client/v1/media/thumbnail</code>. Media uploaded prior to setting this option to true will still be available over the legacy endpoints. Note if the setting is switched to false
 after enabling, media marked as authenticated will be available over legacy endpoints. Defaults to false, but
 this will change to true in a future Synapse release.</p>
+<p>In all cases, authenticated requests to download media will succeed, but for unauthenticated requests, this
+case-by-case breakdown describes whether media downloads are permitted:</p>
+<ul>
+<li><code>enable_authenticated_media = False</code>:
+<ul>
+<li>unauthenticated client or homeserver requesting local media: allowed</li>
+<li>unauthenticated client or homeserver requesting remote media: allowed as long as the media is in the cache,
+or as long as the remote homeserver does not require authentication to retrieve the media</li>
+</ul>
+</li>
+<li><code>enable_authenticated_media = True</code>:
+<ul>
+<li>unauthenticated client or homeserver requesting local media:
+allowed if the media was stored on the server whilst <code>enable_authenticated_media</code> was <code>False</code> (or in a previous Synapse version where this option did not exist);
+otherwise denied.</li>
+<li>unauthenticated client or homeserver requesting remote media: the same as for local media;
+allowed if the media was stored on the server whilst <code>enable_authenticated_media</code> was <code>False</code> (or in a previous Synapse version where this option did not exist);
+otherwise denied.</li>
+</ul>
+</li>
+</ul>
+<p>It is especially notable that media downloaded before this option existed (in older Synapse versions), or whilst this option was set to <code>False</code>,
+will perpetually be available over the legacy, unauthenticated endpoint, even after this option is set to <code>True</code>.
+This is for backwards compatibility with older clients and homeservers that do not yet support requesting authenticated media;
+those older clients or homeservers will not be cut off from media they can already see.</p>
 <p>Example configuration:</p>
 <pre><code class="language-yaml">enable_authenticated_media: true
 </code></pre>