Sender | Message | Time |
---|---|---|
7 Sep 2024 | ||
Alex | i also don't find sharing useful, but i have to live with the fact, that moment implemented a function for it and users might use it for whatever reason :P | 13:52:01 |
Alex | blocking kind of makes sense, but would be unfortunate, as media in moment will be broken until then | 13:52:23 |
nex (she/it) | In reply to @tulir:maunium.netAs in, to all requests? | 13:52:36 |
nex (she/it) | afaik the access token is only added to requests that actually need it | 13:52:54 |
tulir | In reply to @nex:nexy7574.co.ukthere are only a couple of requests that don't need it, but if you wanted to be correct, you could have the send method move the access token from query to header | 13:55:16 |
tulir | my libraries just send access token always if they have it, no reason not to | 13:55:52 |
nex (she/it) | I figured that explicitly sending it for specific endpoints was a deliberate choice but honestly if there's only a few endpoints that don't actually need it I can't see it doing any harm | 13:56:49 |
Alex | even then one could probably hardcode a small list of endpoints to exclude | 14:00:56 |
Alex | but i can't think of any concerns against it either | 14:02:09 |
tulir | I think the list of endpoints is basically anything related to login and register (including things like forgetting passwords), but generally you don't have an access token at all when calling those | 14:04:17 |
tulir | previously media and /_matrix/client/versions didn't need access tokens, but now media requires them and /versions optionally accepts them (servers can enable features per user) | 14:04:45 |
tulir | resolving room aliases, querying user profiles and viewing room directory is marked as not requiring auth in the spec, but that's just the spec lying, because in practice some servers do require auth (the spec is missing a concept of "doesn't require auth by default, but the server can choose to require auth") | 14:06:13 |
Alex | but servers wouldn't deny a request with an unspecified auth header present, would they? | 14:14:23 |
tulir | for login and register they might deny it (because appservices do actually login/register with a token) | 14:16:12 |
tulir | but for calling those it's probably better to just make a new nio client instance that doesn't have a token | 14:16:48 |
nex (she/it) | I don't think nio supports appservices anyway | 14:17:20 |
nex (she/it) | Might be mistaken though, never really looked into them | 14:17:39 |
Alex | actually, patching | 15:58:51 |
nex (she/it) | I'll test that with my client to double check but I can't forsee there being any issues | 17:00:08 |
Alex | also added the patch to my normal client i'm using now. so far no problems/errors (beyond broken avatars due to old servers not supporting the authenticated media api yet, but that's not resolvable without adding complexity like e.g. a retry with the old api on fail) | 17:09:31 |
nex (she/it) | I actually had an idea at one point to query /_matrix/client/versions before using authed media to see if >1.11 was supported, but I couldn't figure out how to do that without requiring another network request (aside from caching it on first sync or something like that) | 17:22:09 |
tulir | In reply to @nex:nexy7574.co.ukare there any benefits to the sans-io architecture or does it just make everything harder? :P | 17:26:11 |
Alex | sorry, i was confused. maybe the client-server api is not the reason, but the server-server api. or maybe the errors are totally unrelated | 17:32:20 |
Alex | i don't know enough about what happens under the hood to resolve this confusion, probably it does not matter anyway, but i'm refering to those messages:
i assume, that using the new api, the server also tries to request the thumbnail from the other server and fails | 17:41:05 |
Alex | via the new api i mean | 17:41:26 |
nex (she/it) | In reply to@tulir:maunium.netFrom what I understand, its mostly just an old thing, as AsyncClient is the only one that's been updated in years (see https://github.com/matrix-nio/matrix-nio/pull/404) | 17:59:50 |
nex (she/it) | It'd be a rather pointless task to change it though, if it ain't broke don't fix it | 18:00:11 |
nex (she/it) | In reply to@timegrid:matrix.c3s.ccI can't see why that'd 404 | 18:01:32 |
nex (she/it) | This is the S2S API version | 18:02:11 |
nex (she/it) | which is a completely different endpoint | 18:02:17 |