Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Should media repo federation requests be signed? #313

Closed
turt2live opened this issue Jun 25, 2018 · 0 comments · Fixed by #1858
Closed

Should media repo federation requests be signed? #313

turt2live opened this issue Jun 25, 2018 · 0 comments · Fixed by #1858
Labels
A-S2S Server-to-Server API (federation) feature Suggestion for a significant extension which needs considerable consideration

Comments

@turt2live
Copy link
Member

Currently synapse does sign the request, however matrix-media-repo doesn't. There's no explicit spec requiring it to be signed, and both projects work fine when they receive a request that isn't signed.

Signing it seems like a good idea, although this should probably be spelled out.

For reference, the current signing method is written here: https://github.com/matrix-org/synapse/blob/752b7b32ed1c33651c0c64fbbb4289c3b62ac89b/synapse/http/matrixfederationclient.py#L262-L285

@turt2live turt2live added the feature Suggestion for a significant extension which needs considerable consideration label Jul 10, 2018
@turt2live turt2live added the A-S2S Server-to-Server API (federation) label Sep 6, 2018
@richvdh richvdh transferred this issue from matrix-org/matrix-spec-proposals Mar 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-S2S Server-to-Server API (federation) feature Suggestion for a significant extension which needs considerable consideration
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants