Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Logging in on a new device can replay stale Incoming Verification Requests which then get stuck. #8629

Closed
ara4n opened this issue Feb 14, 2019 · 3 comments · Fixed by matrix-org/matrix-js-sdk#962

Comments

@ara4n
Copy link
Member

ara4n commented Feb 14, 2019

  1. I logged into my main account fresh on Firefox
  2. I got an Incoming Verification Request from Rick. He was confused, as he doesn't remember even sending it, so it must have been as while ago. I don't remember ever receiving it before.
  3. I hit 'verify'; it showed the whole "waiting for your partner" thing
  4. rick got no alert on his side.
  5. i tried to close the spinner; it failed to close the dialog.
  6. i was therefore unable to use the app and had to hit refresh.

screenshot 2019-02-14 at 14 30 16

@ara4n ara4n changed the title Logging in on a new device can replay stale Incoming Verification Requests with then get stuck. Logging in on a new device can replay stale Incoming Verification Requests which then get stuck. Feb 14, 2019
@Insoleet
Copy link

Insoleet commented Feb 18, 2019

We encoutered the same problem on a private E2E multi-users room. Only two of us (in a room of 4 people) got stuck with this window this morning. After refreshing the page, the window didn't show up again.

@ara4n
Copy link
Member Author

ara4n commented Feb 20, 2019

see also #8807

@turt2live
Copy link
Member

turt2live added a commit to matrix-org/matrix-js-sdk that referenced this issue Jun 19, 2019
Fixes element-hq/element-web#10083
Fixes element-hq/element-web#9197
Fixes element-hq/element-web#8629

The issue is partially fixed by matrix-org/matrix-react-sdk#3123 in that users would no longer see "Incoming request", but would launch their client to a bunch of "key verification cancelled" dialogs. To work around this, we just don't handle key verification requests which we know are cancelled.

The changes are a bit awkward (flagging the event as cancelled instead of filtering it) because:
* We probably don't want to prevent events getting sent over the EventEmitter because applications may still rely on them.
* The cypto side only has visibility of 1 event at a time, so it needs to have some kind of flag to rely on.

An attempt has been made to generalize the new event flag for possible future cases.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants