summary refs log tree commit diff
path: root/synapse/config/auth.py
diff options
context:
space:
mode:
authorPatrick Cloke <clokep@users.noreply.github.com>2021-06-16 11:07:28 -0400
committerGitHub <noreply@github.com>2021-06-16 11:07:28 -0400
commit76f9c701c3920d83c0fe8f08b9197e2e92e12dad (patch)
treeeea41aae32a58a9484d27b975982143b41d65231 /synapse/config/auth.py
parentA guide to the request log lines format. (#8436) (diff)
downloadsynapse-76f9c701c3920d83c0fe8f08b9197e2e92e12dad.tar.xz
Always require users to re-authenticate for dangerous operations. (#10184)
Dangerous actions means deactivating an account, modifying an account
password, or adding a 3PID.

Other actions (deleting devices, uploading keys) can re-use the same UI
auth session if ui_auth.session_timeout is configured.
Diffstat (limited to 'synapse/config/auth.py')
-rw-r--r--synapse/config/auth.py4
1 files changed, 4 insertions, 0 deletions
diff --git a/synapse/config/auth.py b/synapse/config/auth.py
index e10d641a96..53809cee2e 100644
--- a/synapse/config/auth.py
+++ b/synapse/config/auth.py
@@ -103,6 +103,10 @@ class AuthConfig(Config):
             # the user-interactive authentication process, by allowing for multiple
             # (and potentially different) operations to use the same validation session.
             #
+            # This is ignored for potentially "dangerous" operations (including
+            # deactivating an account, modifying an account password, and
+            # adding a 3PID).
+            #
             # Uncomment below to allow for credential validation to last for 15
             # seconds.
             #