Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Return 401 for invalid access_token on logout #2938

Merged
merged 1 commit into from
Apr 9, 2018

Conversation

dklug
Copy link
Contributor

@dklug dklug commented Mar 3, 2018

Fixes #2932

Returns errcode M_UNKNOWN_TOKEN upon invalid token.

Signed-off-by: Duncan Klug <dklug@ucmerced.edu>
@matrixbot
Copy link
Member

Can one of the admins verify this patch?

1 similar comment
@matrixbot
Copy link
Member

Can one of the admins verify this patch?

@richvdh
Copy link
Member

richvdh commented Mar 6, 2018

@matrixbot: test this please

@richvdh
Copy link
Member

richvdh commented Mar 6, 2018

@CobaltCause
Copy link

May I suggest using AuthError.code, AuthError.errcode, and AuthError.msg instead of 401, "M_UNKNOWN_TOKEN", and "Access Token unknown or expired" respectively? This way, the correct values are returned when the token is both invalid and completely missing, and the correct HTTP status code of 403 is used.

@richvdh
Copy link
Member

richvdh commented Apr 9, 2018

As I understand it:

401 is "I don't know who you are"
403 is "I know who you are, but you're not allowed to do what you're asking."

Unlnown token is "I don't know who you are"

@richvdh richvdh merged commit 37354b5 into matrix-org:develop Apr 9, 2018
neilisfragile added a commit that referenced this pull request Apr 27, 2018
Changes in synapse v0.28.0-rc1 (2018-04-26)
===========================================

Bug Fixes:

* Fix quarantine media admin API and search reindex (PR #3130)
* Fix media admin APIs (PR #3134)

Changes in synapse v0.28.0-rc1 (2018-04-24)
===========================================

Minor performance improvement to federation sending and bug fixes.

(Note: This release does not include state resolutions discussed in matrix live)

Features:

* Add metrics for event processing lag (PR #3090)
* Add metrics for ResponseCache (PR #3092)

Changes:

* Synapse on PyPy (PR #2760) Thanks to @Valodim!
* move handling of auto_join_rooms to RegisterHandler (PR #2996) Thanks to @krombel!
* Improve handling of SRV records for federation connections (PR #3016) Thanks to @silkeh!
* Document the behaviour of ResponseCache (PR #3059)
* Preparation for py3 (PR #3061, #3073, #3074, #3075, #3103, #3104, #3106, #3107, #3109, #3110) Thanks to @NotAFile!
* update prometheus dashboard to use new metric names (PR #3069) Thanks to @krombel!
* use python3-compatible prints (PR #3074) Thanks to @NotAFile!
* Send federation events concurrently (PR #3078)
* Limit concurrent event sends for a room (PR #3079)
* Improve R30 stat definition (PR #3086)
* Send events to ASes concurrently (PR #3088)
* Refactor ResponseCache usage (PR #3093)
* Clarify that SRV may not point to a CNAME (PR #3100) Thanks to @silkeh!
* Use str(e) instead of e.message (PR #3103) Thanks to @NotAFile!
* Use six.itervalues in some places (PR #3106) Thanks to @NotAFile!
* Refactor store.have_events (PR #3117)

Bug Fixes:

* Return 401 for invalid access_token on logout (PR #2938) Thanks to @dklug!
* Return a 404 rather than a 500 on rejoining empty rooms (PR #3080)
* fix federation_domain_whitelist (PR #3099)
* Avoid creating events with huge numbers of prev_events (PR #3113)
* Reject events which have lots of prev_events (PR #3118)
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants