Skip to content

reset_cross_signing cannot perform UIA properly for m.oauth #6521

@gingershaped

Description

@gingershaped

While implementing OAuth login in Continuwuity, I discovered that reset_cross_signing, and specifically OAuthCrossSigningResetInfo, does not track the necessary data to correctly perform user-interactive authentication when uploading cross-signing keys if the server returns a flow with a m.oauth stage. Because OAuthCrossSigningResetInfo only contains the reset URL, handle.auth can't be called with an AuthData struct containing a session property, and therefore the SDK will repeatedly start new UIA sessions instead of checking if the existing session has succeeded. Because Synapse does not track sessions for OAuth clients, this will work fine with Synapse, but it doesn't comply with the spec and doesn't work with Continuwuity.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions