2.0 KiB
MSC2611: Remove m.login.token User-Interactive Authentication type from the specification
The client-server API specification defines a number of "authentication types" for use with the User-Interactive Authentication protocol.
Of these, m.login.token is unused and confusing. This MSC proposes removing it.
Proposal
The definition of
token-based
authentication is unclear about how this authentication type should be used. It
suggests "via some external service, such as email or SMS", but in practice
those validation mechanisms have their own token-submission mechanisms (for
example, the
submit_url field of the responses from
/account/password/email/requestToken
and
/account/password/msisdn/requestToken
respectively). Additionally, the specification requires that "the server must
encode the user ID in the token", which seems at odds with any token which can
be sent to a user over SMS.
Additional confusion stems from the presence of an m.login.token login
type, which is used
quite differently: it forms part of the single-sign-on login flow. For clarity:
this proposal does not suggest making any changes to the m.login.token login
type.
In practice, we are not aware of any implementations of the m.login.token
authentication type, and the inconsistency adds unnecessary confusion to the
specification.
Potential Issues
It's possible that somebody has found a use for this mechanism. However, that would necessarily entail some custom development of clients and servers, so is not materially affected by the removal from the specification.