MSC2918: Refresh tokens by sandhose · Pull Request #2918 · matrix-org/matrix-spec-proposals

sandhose · 2020-12-18T13:42:48Z

Rendered

Related: matrix-org/matrix-spec#410, matrix-org/matrix-spec#636

Implementations: synapse, hydrogen, ~~Element Web/Desktop~~ (reverted), Element iOS

FCP proposal: #2918 (comment)

proposals/2918-refreshtokens.md

sandhose · 2021-05-20T10:14:29Z

Just pushed two changes:

the registration API should also issue a refresh token (unless login is inhibited)
token expiration is now in milliseconds instead of seconds

proposals/2918-refreshtokens.md

sandhose

A few recent changes:

d433e3b specify what error code should be used related to this)
b320001 suggest what to do with refresh token revocation on use (this is what is implemented in Synapse)
87566c3 clarify that it also applies to ASes

proposals/2918-refreshtokens.md

sandhose

I'm pretty confortable with the current state of the MSC. The implementation in Synapse is pretty much done and working (matrix-org/synapse#9450) and in a working state in Hydrogen (element-hq/hydrogen-web#235).

proposals/2918-refreshtokens.md

richvdh · 2021-06-30T18:00:44Z

this looks good to me.

@mscbot fcp merge

@dklimpel

Synapse 1.38.0 (2021-07-13) =========================== This release includes a database schema update which could result in elevated disk usage. See the [upgrade notes](https://matrix-org.github.io/synapse/develop/upgrade#upgrading-to-v1380) for more information. No significant changes since 1.38.0rc3. Synapse 1.38.0rc3 (2021-07-13) ============================== Internal Changes ---------------- - Build the Debian packages in CI. ([\matrix-org#10247](matrix-org#10247), [\matrix-org#10379](matrix-org#10379)) Synapse 1.38.0rc2 (2021-07-09) ============================== Bugfixes -------- - Fix bug where inbound federation in a room could be delayed due to not correctly dropping a lock. Introduced in v1.37.1. ([\matrix-org#10336](matrix-org#10336)) Improved Documentation ---------------------- - Update links to documentation in the sample config. Contributed by @dklimpel. ([\matrix-org#10287](matrix-org#10287)) - Fix broken links in [INSTALL.md](INSTALL.md). Contributed by @dklimpel. ([\matrix-org#10331](matrix-org#10331)) Synapse 1.38.0rc1 (2021-07-06) ============================== Features -------- - Implement refresh tokens as specified by [MSC2918](matrix-org/matrix-spec-proposals#2918). ([\matrix-org#9450](matrix-org#9450)) - Add support for evicting cache entries based on last access time. ([\matrix-org#10205](matrix-org#10205)) - Omit empty fields from the `/sync` response. Contributed by @deepbluev7. ([\matrix-org#10214](matrix-org#10214)) - Improve validation on federation `send_{join,leave,knock}` endpoints. ([\matrix-org#10225](matrix-org#10225), [\matrix-org#10243](matrix-org#10243)) - Add SSO `external_ids` to the Query User Account admin API. ([\matrix-org#10261](matrix-org#10261)) - Mark events received over federation which fail a spam check as "soft-failed". ([\matrix-org#10263](matrix-org#10263)) - Add metrics for new inbound federation staging area. ([\matrix-org#10284](matrix-org#10284)) - Add script to print information about recently registered users. ([\matrix-org#10290](matrix-org#10290)) Bugfixes -------- - Fix a long-standing bug which meant that invite rejections and knocks were not sent out over federation in a timely manner. ([\matrix-org#10223](matrix-org#10223)) - Fix a bug introduced in v1.26.0 where only users who have set profile information could be deactivated with erasure enabled. ([\matrix-org#10252](matrix-org#10252)) - Fix a long-standing bug where Synapse would return errors after 2<sup>31</sup> events were handled by the server. ([\matrix-org#10264](matrix-org#10264), [\matrix-org#10267](matrix-org#10267), [\matrix-org#10282](matrix-org#10282), [\matrix-org#10286](matrix-org#10286), [\matrix-org#10291](matrix-org#10291), [\matrix-org#10314](matrix-org#10314), [\matrix-org#10326](matrix-org#10326)) - Fix the prometheus `synapse_federation_server_pdu_process_time` metric. Broke in v1.37.1. ([\matrix-org#10279](matrix-org#10279)) - Ensure that inbound events from federation that were being processed when Synapse was restarted get promptly processed on start up. ([\matrix-org#10303](matrix-org#10303)) Improved Documentation ---------------------- - Move the upgrade notes to [docs/upgrade.md](https://github.com/matrix-org/synapse/blob/develop/docs/upgrade.md) and convert them to markdown. ([\matrix-org#10166](matrix-org#10166)) - Choose Welcome & Overview as the default page for synapse documentation website. ([\matrix-org#10242](matrix-org#10242)) - Adjust the URL in the README.rst file to point to irc.libera.chat. ([\matrix-org#10258](matrix-org#10258)) - Fix homeserver config option name in presence router documentation. ([\matrix-org#10288](matrix-org#10288)) - Fix link pointing at the wrong section in the modules documentation page. ([\matrix-org#10302](matrix-org#10302)) Internal Changes ---------------- - Drop `Origin` and `Accept` from the value of the `Access-Control-Allow-Headers` response header. ([\matrix-org#10114](matrix-org#10114)) - Add type hints to the federation servlets. ([\matrix-org#10213](matrix-org#10213)) - Improve the reliability of auto-joining remote rooms. ([\matrix-org#10237](matrix-org#10237)) - Update the release script to use the semver terminology and determine the release branch based on the next version. ([\matrix-org#10239](matrix-org#10239)) - Fix type hints for computing auth events. ([\matrix-org#10253](matrix-org#10253)) - Improve the performance of the spaces summary endpoint by only recursing into spaces (and not rooms in general). ([\matrix-org#10256](matrix-org#10256)) - Move event authentication methods from `Auth` to `EventAuthHandler`. ([\matrix-org#10268](matrix-org#10268)) - Re-enable a SyTest after it has been fixed. ([\matrix-org#10292](matrix-org#10292))

MSC: matrix-org/matrix-spec-proposals#2918 Fixes element-hq/element-web#18698 Fixes element-hq/element-web#20648 **Requires matrix-org/matrix-js-sdk#2178 **Note**: There's a lot of logging in this PR. That is intentional to ensure that if/when something goes wrong we can chase the exact code path. It does not log any tokens - just where the code is going. Overall, it should be fairly low volume spam (and can be relaxed at a later date). ---- This approach uses indexeddb (through a mutex library) to manage which tab actually triggers the refresh, preventing issues where multiple tabs try to update the token. If multiple tabs update the token then the server might consider the account hacked and hard logout all the tokens. If for some reason the timer code gets it wrong, or the user has been offline for too long and the token can't be refreshed, they should be sent to a soft logout screen by the server. This will retain the user's encryption state - they simply need to reauthenticate to get an active access token again. This additionally contains a change to fix soft logout not working, per the issue links above. Of interest may be the IPC approach which was ultimately declined in favour of this change instead: #7803

uhoreg · 2022-05-04T20:13:19Z

FTR, I'm working on the spec PR for this

turt2live · 2022-05-20T01:43:39Z

Spec PR: matrix-org/matrix-spec#1056

uhoreg · 2022-06-02T20:30:02Z

merged! 🎉

anoadragon453 · 2022-10-10T19:11:35Z

I've added Element Web and iOS implementations of this MSC to the PR description.

turt2live · 2022-10-11T06:10:05Z

@anoadragon453 ftr, the web implementation was reverted: matrix-org/matrix-react-sdk#7821

anoadragon453 · 2022-10-14T13:17:26Z

Oh, thanks for letting me know!

Refresh tokens MSC

ab50b62

sandhose changed the title ~~MSC2918: Refresh tokens~~ MSC2918: [WIP] Refresh tokens Dec 18, 2020

clokep reviewed Dec 18, 2020

View reviewed changes

proposals/2918-refreshtokens.md Outdated Show resolved Hide resolved

proposals/2918-refreshtokens.md Show resolved Hide resolved

proposals/2918-refreshtokens.md Outdated Show resolved Hide resolved

MSC2918: minor changes

f8dad2a

turt2live added kind:feature MSC for not-core and not-maintenance stuff proposal A matrix spec change proposal proposal-in-review labels Jan 14, 2021

turt2live changed the title ~~MSC2918: [WIP] Refresh tokens~~ [WIP] MSC2918: Refresh tokens Jan 14, 2021

turt2live removed the proposal-in-review label Jan 14, 2021

turt2live marked this pull request as draft January 14, 2021 16:53

This was referenced Feb 19, 2021

WIP: MSC2918 initial implementation element-hq/hydrogen-web#235

Draft

MSC2918 Refresh tokens implementation matrix-org/synapse#9450

Merged

richvdh reviewed May 4, 2021

View reviewed changes

proposals/2918-refreshtokens.md Outdated Show resolved Hide resolved

sandhose added 3 commits May 20, 2021 12:09

MSC2918: access token expiration as milliseconds

0e615f7

MSC2918: account registration API changes

870cded

MSC2918: fix expires_in_ms example

6530ecc

richvdh reviewed Jun 2, 2021

View reviewed changes

proposals/2918-refreshtokens.md Show resolved Hide resolved

sandhose added 3 commits June 3, 2021 16:23

MSC2918: add precision about token revocation

b320001

MSC2918: specify error codes for the refresh API

d433e3b

MSC2918: clarify that the change also applies to ASes

87566c3

sandhose commented Jun 3, 2021

View reviewed changes

proposals/2918-refreshtokens.md Show resolved Hide resolved

turt2live added the needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. label Jun 8, 2021

sandhose marked this pull request as ready for review June 17, 2021 10:51

sandhose commented Jun 17, 2021

View reviewed changes

proposals/2918-refreshtokens.md Show resolved Hide resolved

sandhose changed the title ~~[WIP] MSC2918: Refresh tokens~~ MSC2918: Refresh tokens Jun 17, 2021

richvdh removed the needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. label Jun 24, 2021

richvdh self-requested a review June 24, 2021 13:23

richvdh reviewed Jun 30, 2021

View reviewed changes

proposals/2918-refreshtokens.md Outdated Show resolved Hide resolved

proposals/2918-refreshtokens.md Outdated Show resolved Hide resolved

proposals/2918-refreshtokens.md Outdated Show resolved Hide resolved

proposals/2918-refreshtokens.md Outdated Show resolved Hide resolved

turt2live added spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec and removed finished-final-comment-period labels Oct 1, 2021

turt2live self-assigned this Jan 1, 2022

bradjones1 mentioned this pull request Jan 28, 2022

Support refresh tokens matrix-org/matrix-js-sdk#2141

Closed

This was referenced Feb 15, 2022

Add functions to support refresh tokens matrix-org/matrix-js-sdk#2177

Closed

Support refresh tokens matrix-org/matrix-react-sdk#7802

Merged

Add functions to support refresh tokens matrix-org/matrix-js-sdk#2178

Merged

turt2live assigned uhoreg and unassigned turt2live May 4, 2022

uhoreg mentioned this pull request May 10, 2022

Add spec for refresh tokens matrix-org/matrix-spec#1056

Merged

turt2live mentioned this pull request May 16, 2022

Matrix 1.3 matrix-org/matrix-spec#1063

Closed

15 tasks

turt2live added spec-pr-in-review A proposal which has been PR'd against the spec and is in review and removed spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec labels May 24, 2022

hughns mentioned this pull request May 25, 2022

Use something more secure than bearer tokens for auth matrix-org/matrix-spec#259

Open

uhoreg added merged A proposal whose PR has merged into the spec! and removed spec-pr-in-review A proposal which has been PR'd against the spec and is in review labels Jun 2, 2022

zecakeh mentioned this pull request Jun 3, 2022

Incorporate Matrix v1.3 changes ruma/ruma#1145

Closed

66 tasks

zecakeh mentioned this pull request Jun 11, 2022

client-api: Add support for refresh tokens ruma/ruma#1176

Merged

richvdh mentioned this pull request Feb 17, 2023

Stabilise support for MSC2918 refresh tokens as they have now been merged into the Matrix specification. matrix-org/synapse#11435

Merged

hughns mentioned this pull request Feb 23, 2023

Implementation of MSC2918 refresh tokens makes transaction ID scoping in violation of spec matrix-org/synapse#15141

Closed

S7evinK mentioned this pull request Sep 29, 2023

Declare support for Matrix 1.3 matrix-org/dendrite#3219

Open

16 tasks

matrixbot mentioned this pull request Nov 1, 2024

Declare support for Matrix 1.3 element-hq/dendrite#3219

Open

16 tasks

Conversation

sandhose commented Dec 18, 2020 • edited by anoadragon453 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sandhose commented May 20, 2021

Uh oh!

Uh oh!

sandhose left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sandhose left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

richvdh commented Jun 30, 2021

Uh oh!

uhoreg commented May 4, 2022

Uh oh!

turt2live commented May 20, 2022

Uh oh!

uhoreg commented Jun 2, 2022

Uh oh!

anoadragon453 commented Oct 10, 2022

Uh oh!

turt2live commented Oct 11, 2022

Uh oh!

anoadragon453 commented Oct 14, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

sandhose commented Dec 18, 2020 •

edited by anoadragon453

Loading