Synapse requires auth for GET /_matrix/client/.../publicRooms, contrary to spec

[Ah3n0]

Description

GET /_matrix/client/v1/register/m.login.registration_token/validity

Steps to reproduce

GET Request : url=http://localhost:8008/_matrix/client/v1/register/m.login.registration_token/validity 
 path_url=/_matrix/client/v1/register/m.login.registration_token/validity 
 headers={'User-Agent': 'python-requests/2.28.1', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'} 
 body=None 

Homeserver

own

Synapse Version

1.73

Installation Method

Docker (matrixdotorg/synapse)

Database

PostgreSQL

Workers

Single process

Platform

K8s Cluster

Configuration

No response

Relevant log output

GET Response : url=http://localhost:8008/_matrix/client/v1/register/m.login.registration_token/validity 
 status=400, reason=Bad Request 
 headers={'Transfer-Encoding': 'chunked', 'Server': 'Synapse/1.73.0', 'Date': 'Fri, 10 Feb 2023 10:09:05 GMT', 'Content-Type': 'application/json', 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET, HEAD, POST, PUT, DELETE, OPTIONS', 'Access-Control-Allow-Headers': 'X-Requested-With, Content-Type, Authorization, Date'} 
 body={"errcode":"M_MISSING_PARAM","error":"Missing string query parameter 'token'"}

Anything else that would be useful to know?

[DMRobertson]

Please link to the spec rather than post a screenshot of it.

https://spec.matrix.org/v1.5/client-server-api/#get_matrixclientv1registermloginregistration_tokenvalidity

The complaint in the response is that you haven't provided the required query parameter token, the registration token to check the validity of. You haven't demonstrated that this endpoint requires authentication.

[Ah3n0]

@DMRobertson My bad, it was an other endpoint. Sorry for this confusion:

[DMRobertson]

Confusingly, the link you have provided is to the GET .../forget endpoint, not /publicRooms.

/publicRooms is specced as requiring auth so Synapse is not spec-compliant. I am not clear if Synapse should be changed or if the spec should.

[DMRobertson]

synapse/synapse/rest/client/room.py

Lines 445 to 446 in 1182ae5

	try:
	await self.auth.get_user_by_req(request, allow_guest=True)

is presumably responsible.

[Ah3n0]

Confusingly, the link you have provided is to the GET .../forget endpoint, not /publicRooms.

/publicRooms is specced as requiring auth so Synapse is not spec-compliant. I am not clear if Synapse should be changed or if the spec should.

Link updated to 'GET /_matrix/client/v3/publicRooms'

[DMRobertson]

Note that the POST version of public rooms does require auth in the spec. (Though I don't understand why.)

[DMRobertson]

Discussed among the team. We think the spec should mark this as requiring auth.

[DMRobertson]

Related: #2421 matrix-org/matrix-spec#145