archive
/
matrix-spec-proposals
mirror of https://github.com/matrix-org/matrix-spec-proposals
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clarify redirects that should be followed, add maximum size

Browse Source 
Signed-off-by: Aaron Raimist <aaron@raim.ist>
pull/2499/head
Aaron Raimist 5 years ago
parent 2f197969fe
commit 9ca1b651b7
No known key found for this signature in database
GPG Key ID: 37419210002890EF
1 changed files with 18 additions and 15 deletions
Show Stats Download Patch File Download Diff File

33
proposals/2499-client-well-known-fixes.md
Unescape Escape View File

@ -1,23 +1,23 @@
# MSC2499: Fixes for Client Well-known URI # MSC2499: Fixes for Well-Known URIs
Several minor issues and inconsistencies have cropped up since the `/.well-known/matrix/client` Several minor issues and inconsistencies have come up with the well-known URIs used for
method was added to allow clients to discover servers. This proposal intends to fix these issues. discovering clients and servers. This proposal intends to fix these issues.
## Proposal ## Proposal
The following changes should be made to the client server spec: The following changes should be made to the spec:
1. The spec does not mention that redirects should be followed. The spec should be changed to 1. The spec does not mention that redirects should be followed for `/.well-known/matrix/client`
state that when a client is looking up the well-known URI, it should follow HTTP 3xx redirects and does not clearly specify what type of redirects should be followed for `/.well-known/matrix/server`.
up to 30 times. This is consistent with the redirects followed when a server resolves a To fix this, the spec should be changed to state that when a well-known URI is requested,
server name using `/.well-known/matrix/server`. the client or server should follow HTTP 301, 302, 303, 307, and 308 redirects up to 30 times.
1. Currently the spec does not mention which Content-Type should be used for the response to 1. Currently the spec does not mention which Content-Type should be used for the response to
`/.well-known/matrix/client`. The Content-Type SHOULD be `application/json` however it `/.well-known/matrix/client`. The Client-Server spec should be changed to state the Content-Type
should be assumed to be JSON regardless of type. This is consistent with the Server-Server API. SHOULD be `application/json` however it should be assumed to be JSON regardless of Content-Type.
This is consistent with the Server-Server API.
1. When a client is following the flow described in the spec for looking up `/.well-known/matrix/client`, 1. The Client-Server spec for looking up `/.well-known/matrix/client` currently states, in part:
the spec currently states, in part:
> 3․ Make a GET request to https://hostname/.well-known/matrix/client.<br> > 3․ Make a GET request to https://hostname/.well-known/matrix/client.<br>
>> a․ If the returned status code is 404, then `IGNORE`.<br> >> a․ If the returned status code is 404, then `IGNORE`.<br>
@ -30,6 +30,9 @@ the spec currently states, in part:
This change does have potential security concerns, see https://github.com/vector-im/riot-web/issues/11136. This change does have potential security concerns, see https://github.com/vector-im/riot-web/issues/11136.
1. Step 3f in the flow should be changed to use the modern `/_matrix/identity/v2` API to 1. Step 3f in the Client-Server well-known flow should be changed to use the modern
validate the identity server rather than the deprecated `/_matrix/identity/api/v1`. Clients `/_matrix/identity/v2` API to validate the identity server rather than the deprecated
should fall back to the v1 API as described in the identity service spec. `/_matrix/identity/api/v1`.
1. The maximum size of size of the well-known file is 51200 bytes. A client or server
requesting a well-known file MUST abort and FAIL_PROMPT if the response exceeds 51200 bytes.
Write Preview
Loading…
Cancel
Save