/keys/device_signing/upload should not pass an empty auth object initially

[avdb13]

Steps to reproduce

While working on Conduit I noticed that when Element web calls /keys/device_signing/upload it passes an empty auth object in the initial request which is problematic as this leads to the assumption that the object contains a UIA session identifier. To reproduce one simply has to register a new account.

Related: matrix-org/matrix-spec-proposals#3967

Outcome

auth should only be present in the request when it contains a valid session identifier.

Operating system

non-applicable

Browser information

librewolf-bin-125.0.3

URL for webapp

app.element.io

Application version

Element version: 1.11.67

Homeserver

non-applicable

Will you send logs?

No

[t3chguy]

which is problematic as this leads to the assumption that the object contains a UIA session identifier. To reproduce one simply has to register a new account.

Where in the spec does it say to not do this?

The auth field and its contents are both optional which implies both are valid approaches.

[avdb13]

which is problematic as this leads to the assumption that the object contains a UIA session identifier. To reproduce one simply has to register a new account.

Where in the spec does it say to not do this?

The auth field and its contents are both optional which implies both are valid approaches.

https://spec.matrix.org/v1.10/client-server-api/#user-interactive-api-in-the-rest-api

A client should first make a request with no auth parameter.

[t3chguy]

the verb used there is should not must so this is not against the spec inherently

[t3chguy]

Given the spec says should rather than must and that UIA is on the way out in favour of OIDC I'm not sure this will be resolved.

[avdb13]

Given the spec says should rather than must and that UIA is on the way out in favour of OIDC I'm not sure this will be resolved.

I see, thanks for clarifying.