From 5c96f455569b69ba841f1a456b3eab660bde5b9f Mon Sep 17 00:00:00 2001 From: Tulir Asokan Date: Tue, 19 Mar 2024 16:59:00 +0200 Subject: [PATCH] Specify that appservice login and register fail on incorrect as_tokens (#1744) Signed-off-by: Tulir Asokan --- .../application_service/newsfragments/1744.clarification | 1 + content/application-service-api.md | 6 ++++++ 2 files changed, 7 insertions(+) create mode 100644 changelogs/application_service/newsfragments/1744.clarification diff --git a/changelogs/application_service/newsfragments/1744.clarification b/changelogs/application_service/newsfragments/1744.clarification new file mode 100644 index 00000000..908c48ab --- /dev/null +++ b/changelogs/application_service/newsfragments/1744.clarification @@ -0,0 +1 @@ +Clarify that the `/login` and `/register` endpoints should fail when using the `m.login.application_service` login type without a valid `as_token`. diff --git a/content/application-service-api.md b/content/application-service-api.md index f3db06cf..a7526e64 100644 --- a/content/application-service-api.md +++ b/content/application-service-api.md @@ -436,6 +436,12 @@ an application service-defined namespace will receive the same `M_EXCLUSIVE` error code, but only if the application service has defined the namespace as `exclusive`. +If `/register` or `/login` is called with the `m.login.application_service` +login type, but without a valid `as_token`, the endpoints will return an error +with the `M_MISSING_TOKEN` or `M_UNKNOWN_TOKEN` error code and 401 as the HTTP +status code. This is the same behavior as invalid auth in the client-server API +(see [Using access tokens](/client-server-api/#using-access-tokens)). + #### Pinging {{% added-in v="1.7" %}}