Filip/matrix-spec
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-spec synced 2026-03-06 19:54:09 +01:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Specify that the /openid/userinfo return value must be validated

Browse source
This commit is contained in:
Tulir Asokan 2025-12-30 17:57:44 +02:00
parent 2f6867348f
commit fd1fcf8d2c
2 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelogs/server_server/newsfragments/2288.clarification Normal file
View file

@ -0,0 +1 @@
Specify that callers of `/_matrix/federation/v1/openid/userinfo` must validate the returned user ID.

7
data/api/server-server/openid.yaml
View file

@ -43,7 +43,12 @@ paths:
properties: properties:
sub: sub:
type: string type: string
description: The Matrix User ID who generated the token. description: |
The Matrix User ID who generated the token.
The caller MUST validate that the returned user ID is on the server they
called (i.e. if you make a request to example.com and it returns
`@alice:matrix.org`, the result is invalid).
example: "@alice:example.com" example: "@alice:example.com"
required: required:
- sub - sub