Verify matrix webhook session

immanuelfodor / matrix-encrypted-webhooks

Send any JSON and form data through webhooks to Matrix end-to-end encrypted (E2EE) rooms with HTTP POST requests

MIT License

18 stars 5 forks source link

Verify matrix webhook session #5

Open enter286 opened 2 weeks ago

enter286 commented 2 weeks ago

Is it possible to verify the matrix session from this webhook? As all messages sent from the webhook currently have a warning that the session isn't verified.

I tried verifying from another session in my browser, but that does send a message to this client, but I don't see a way to receive it?

enter286 commented 2 weeks ago

Tried to manually enter the device_id and access_token in the credentials.json as described here: https://github.com/immanuelfodor/matrix-encrypted-webhooks/issues/1#issuecomment-900852819

The error message under the red exclamation mark changed from: Encrypted by a device not verified by its owner to Encrypted by an unknown or deleted device.

immanuelfodor commented 2 weeks ago

It's possible to do manual or emoji verification with the Nio library that this project uses, but it's not (yet) implemented in the E2EEClient.py, so you can't do it today. The linked comment is about another topic with SSO login, it's unrelated to yours.

Why I haven't implemented verification?

I'm the only user
The whole thing runs in a private network with no external access
Only Element is reluctant to complain about trust, better clients, such as SchildiChat don't complain
Even larger projects, such as Mautrix bridges don't implement it, so if it seems "good enough" to them, then it's good enough to me :grinning:

But I'm happy to accept a PR if you (or anybody else) add verification to the project! :pray:

enter286 commented 2 weeks ago

For some reason I had verification working without issues on a previous server installation. Just moved it to a new server this week and for some reason can't get it to appear as verified anymore.

Really appreciate your response. Just wanted to make sure there wasn't an easy fix I'm overlooking.

immanuelfodor commented 2 weeks ago

Yeah, nothing to worry about, the bot messages are still end-to-end encrypted, it's just a "cosmetic annoyance" by the Element clients.