mirror of
https://github.com/element-hq/synapse.git
synced 2026-11-06 19:37:55 +00:00
Hugh Nimmo-Smith
8e1e7dc0af
This PR should be reviewable on a commit-by-commit basis. If you would prefer that it is broken down into multiple PRs then I can do so. Fixes to match latest MSC4388: - Return `200` with `create_available=false` for `GET` when configured in `authenticated` mode and no access token presented - Return `401` for a `GET` where an invalid/expired token is presented - Return `404` for `DELETE` where session has expired but not yet evicted Features: - Rate limiting which is configurable via `experimental_features.msc4388_rc_create` (for `POST` and is per requester for authenticated requests or per client IP for unauthenticated requests) and `experimental_features.msc4388_rc_requests` (for `GET`/`PUT`/`DELETE`). - Allow the session TTL to be configured via the `experimental_features.msc4388_session_ttl`. As per spec this is between 2 and 5 minutes. - Concurrent sessions are unlimited for authenticated requesters (subject to the rate limits). - Unauthenticated requesters have a maximum concurrent sessions limit (default 1,000) which is configurable by `experimental_features.msc4388_max_unauthenticated_sessions`. Misc: - Code and comment cleanup The experimental feature is tracked by https://github.com/element-hq/synapse/issues/19433 and I will update it with the new config options when this PR merges.