You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
matrix-spec-proposals/proposals/2832-appservice-auth-fix.md

1.2 KiB

MSC2832: Homeserver -> Application Service authorization header

Most of the auth tokens in the spec are passed in the Authorization header, with the access_token query parameter supported for backwards-compatibility. For some reason, the application service spec was not updated in the same way and it still requires using the archaic query parameter when the homeserver pushes transactions to the appservice.

Proposal

The access_token query parameter is removed from all requests made by the homeserver to appservice and is replaced with the Authorization header with Bearer <token> as the value.

Backwards-compatibility

Homeservers which want to support old spec versions in the appservice API may send both the query parameter and header. Similarly, appservices may accept the token from either source.

Security considerations

Not fixing this causes access tokens to be logged in many bridges.

Alternatives

We could add a way for appservices to explicitly specify which spec version they want in order to implement backwards-compatibility without sending both tokens.

Unstable prefix

The authorization header is already used in the client-server spec, and an unstable prefix would just unnecessarily complicate things.