From 55d33e2964b2c9668e358c69ab3923649fe68b30 Mon Sep 17 00:00:00 2001 From: Travis Ralston Date: Wed, 14 Feb 2024 20:23:41 -0700 Subject: [PATCH] use multiple headers --- proposals/4100-scoped-signing-keys.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/proposals/4100-scoped-signing-keys.md b/proposals/4100-scoped-signing-keys.md index 5be7e2a3..1f025fb9 100644 --- a/proposals/4100-scoped-signing-keys.md +++ b/proposals/4100-scoped-signing-keys.md @@ -111,8 +111,9 @@ keys may be used for `X-Matrix-Scoped`. `X-Matrix` thus becomes deprecated, and non-scoped keys. Requests containing both `X-Matrix` and `X-Matrix-Scoped` auth *must* be valid in their respective -schemes, otherwise the request is failed. Servers *should* send both if possible, or otherwise downgrade -their requests to `X-Matrix` if an auth error is received for `X-Matrix-Scoped` alone. +schemes, otherwise the request is failed. Servers *should* use both in independent `Authorization` +headers if possible, or otherwise downgrade their requests to `X-Matrix` if an auth error is received +for `X-Matrix-Scoped` alone. > **TODO**: Verify this approach is compatible with existing servers. ie: that they don't fail requests > due to unknown auth schemes being present (when combined with `X-Matrix`).