matrix-org / matrix-spec

The Matrix protocol specification
Apache License 2.0
188 stars 94 forks source link

`POST /_matrix/client/v3/account/password` has authentication set as required but description says it is optional #1807

Closed zecakeh closed 3 months ago

zecakeh commented 5 months ago

Link to problem area: https://spec.matrix.org/v1.10/client-server-api/#post_matrixclientv3accountpassword

Issue

The table of the endpoint shows:

Requires authentication: Yes

However the description has these 2 sentences:

An access token should be submitted to this endpoint if the client has an active session.

The homeserver may change the flows available depending on whether a valid access token is provided.

Which means that the access token is actually optional.

Expected behaviour

Although that was not a thing before, https://github.com/matrix-org/matrix-spec/pull/1728 has added the possibility to display:

Requires authentication: Optional

A simple change in the OpenAPI definition should be enough to fix that.

I have not done a thorough search to know if other endpoints are affected.