Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

org.matrix.login.jwt login succeeded even if user is deactivated #12274

Closed
#15624
Closed
org.matrix.login.jwt login succeeded even if user is deactivated#12274
#15624
Assignees
clokep
Labels
A-Account-Deactivation"Deleting"/"Removing" a user, GDPR erasure (erased)S-MinorBlocks non-critical functionality, workarounds exist.T-DefectBugs, crashes, hangs, security vulnerabilities, or other reported issues.
@laurent-treeb

Description

@laurent-treeb
laurent-treeb
opened on Mar 23, 2022

Version: 1.46 to 1.54

  1. Server configured with jwt_config.enabled=true
  2. Login a test user with type=org.matrix.login.jwt and token
  3. With admin user, deactivate the test user /_synapse/admin/v1/deactivate/{userid}
  4. Relogin the test user with type=org.matrix.login.jwt and token
    • -> here the login is success
    • => should be refused with 403 M_USER_DEACTIVATED

Metadata

Metadata

Assignees

Labels

A-Account-Deactivation"Deleting"/"Removing" a user, GDPR erasure (erased)S-MinorBlocks non-critical functionality, workarounds exist.T-DefectBugs, crashes, hangs, security vulnerabilities, or other reported issues.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions