matrix-org / matrix-spec

The Matrix protocol specification
Apache License 2.0
188 stars 94 forks source link

Distinction between deleting devices and invalidating access tokens is bogus and confusing #1950

Open dkasak opened 2 weeks ago

dkasak commented 2 weeks ago

Suggestion

The difference between "deleting a device" (via https://spec.matrix.org/v1.11/client-server-api/#post_matrixclientv3delete_devices) and "logging out an access token" (via e.g. https://spec.matrix.org/v1.11/client-server-api/#post_matrixclientv3logout) is not terribly clear. After some discussion in #matrix-spec, it appears there is no difference, since:

So essentially the same operation is approached from two different angles: one from the perspective of deleting a device (and invalidating all of its access tokens) and the other from the perspective of invalidating an access token (and deleting its device and other access tokens).

This makes /delete_devices a weird odd beast. It would make more sense to have a /logout/some instead.