Skip to content

Commit

Permalink
Ensure remote signing keys expire after at most 7 days
Browse files Browse the repository at this point in the history
  • Loading branch information
turt2live committed Aug 30, 2024
1 parent eb774d8 commit fb6904a
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 1 deletion.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),

* Return a 404 instead of 500 when clients access media which is frozen.
* Ensure the request parameters are correctly set for authenticated media client requests.
* Ensure remote signing keys expire after at most 7 days.

## [1.3.7] - July 30, 2024

Expand Down
5 changes: 4 additions & 1 deletion matrix/requests_signing.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"encoding/json"
"errors"
"fmt"
"math"
"net/http"
"sync"
"time"
Expand Down Expand Up @@ -128,11 +129,13 @@ func QuerySigningKeys(serverName string) (ServerSigningKeys, error) {
if keyInfo.ServerName != serverName {
return nil, fmt.Errorf("got keys for '%s' but expected '%s'", keyInfo.ServerName, serverName)
}
maxValidity := time.Now().Add(7 * 24 * time.Hour)
if keyInfo.ValidUntilTs <= util.NowMillis() {
return nil, errors.New("returned server keys are expired")
}
keyInfo.ValidUntilTs = int64(math.Min(float64(keyInfo.ValidUntilTs), float64(maxValidity.UnixMilli())))
cacheUntil := time.Until(time.UnixMilli(keyInfo.ValidUntilTs)) / 2
if cacheUntil <= (6 * time.Second) {
if cacheUntil <= (1 * time.Minute) {
return nil, errors.New("returned server keys would expire too quickly")
}

Expand Down

0 comments on commit fb6904a

Please sign in to comment.