diff options
| author | Quentin Gliech <quenting@element.io> | 2022-06-14 15:12:08 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-06-14 09:12:08 -0400 |
| commit | fe1daad67237c2154a3d8d8cdf6c603f0d33682e (patch) | |
| tree | 82aba1f5c2a88a5759444d04a56acda35e5a8cc1 /changelog.d | |
| parent | Fix Complement runs always being Postgres (#13034) (diff) | |
| download | synapse-fe1daad67237c2154a3d8d8cdf6c603f0d33682e.tar.xz | |
Move the "email unsubscribe" resource, refactor the macaroon generator & simplify the access token verification logic. (#12986)
This simplifies the access token verification logic by removing the `rights` parameter which was only ever used for the unsubscribe link in email notifications. The latter has been moved under the `/_synapse` namespace, since it is not a standard API. This also makes the email verification link more secure, by embedding the app_id and pushkey in the macaroon and verifying it. This prevents the user from tampering the query parameters of that unsubscribe link. Macaroon generation is refactored: - Centralised all macaroon generation and verification logic to the `MacaroonGenerator` - Moved to `synapse.utils` - Changed the constructor to require only a `Clock`, hostname, and a secret key (instead of a full `Homeserver`). - Added tests for all methods.
Diffstat (limited to 'changelog.d')
| -rw-r--r-- | changelog.d/12986.misc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/changelog.d/12986.misc b/changelog.d/12986.misc new file mode 100644 index 0000000000..937b888023 --- /dev/null +++ b/changelog.d/12986.misc @@ -0,0 +1 @@ +Refactor macaroon tokens generation and move the unsubscribe link in notification emails to `/_synapse/client/unsubscribe`. |