search

girlbossceo / conduwuit

a very cool, featureful fork of conduit
https://conduwuit.puppyirl.gay/
Apache License 2.0
383 stars 48 forks source link

Unable to fetch remote authenticated media from unauthenticated c2s endpoints #586

Open tusooa opened 2 weeks ago

tusooa commented 2 weeks ago

If my understanding of the code is right, the problem lies in https://github.com/girlbossceo/conduwuit/blob/main/src/api/client/media_legacy.rs#L150C4-L150C76 , which will only request the remote unauthenticated s2s endpoint before trying the authenticated endpoint, if the c2s request is coming from the unauthenticated endpoint.

jevolk commented 2 weeks ago

This is intended behavior. If the client is not authenticated it doesn't enjoy authenticated media.

girlbossceo commented 2 weeks ago

Yes this is expected. Fetching authenticated media over unauthenticated endpoints would be a security issue.

Is there something you're running into that's causing this concern?

tusooa commented 2 weeks ago

Yes this is expected. Fetching authenticated media over unauthenticated endpoints would be a security issue.

Is there something you're running into that's causing this concern?

I'm using a client that does not yet support authenticated media, and all matrix.org media won't load. It seems weird that federation is not transparent through csapi.

girlbossceo commented 2 weeks ago

I do agree it is an unfortunate state of things that pretty much none of this is transparent and older clients, most specifically SchildiChat which is still a perfectly good client, are basically unusable now because this is not transparent; and because this was very, very rushed and shoehorned through. But it may likely upset a lot of folks or cause security issues/concerns if we made this transparent on the server-side and I don't want to step into that territory.