matrix-org / synapse

Synapse: Matrix homeserver written in Python/Twisted.

https://matrix-org.github.io/synapse

Apache License 2.0

11.82k stars 2.13k forks source link

Synapse accepts /forget without a request body but this is not meant to be allowed by the specification #16366

Open reivilibre opened 1 year ago

reivilibre commented 1 year ago

Like all PUT and POST requests other than the media ones (and /logout...), /forget is supposed to take a JSON body, e.g. {} if nothing special is required. Currently Synapse as at v1.92.3 does not require this.

16365 adds a warning against this.

We should see if any clients are hitting this and then a future version should cut this off completely.