Skip to content

Don't delete e-mail validation sessions when the checking if the session was validated #8086

Open
@matrixbot

Description

This issue has been migrated from #8086.


With the current e-mail validation flow the user can be presented with a blank white page that says "Unknown session_id" pretty easily. The flow is something like the following:

  1. The user is sent a validation e-mail.
  2. The e-mail validation link is clicked and Synapse ensures that the data matches and marks the e-mail as valid.
  3. The user gets redirected to wherever their client wants based on the next_link parameter.
  4. If a user has left Element running somewhere (maybe in a background tab, or on another device) it continually polls in the background and notices that the e-mail is now valid). It then deletes the e-mail validation session.
  5. The application continues with whatever is left in the registration flow (or logs the user in).

Unfortunately it seems that some e-mail providers do content scanning on links, so they automatically visit a link before the user sees it. With that, the flow is modified a bit:

  1. Step 1 from above happens as expected.
  2. Before the user sees the e-mail the link is visited.
  3. Since there's an app polling in the background, steps 2 - 4 happen.
  4. The user urgently refreshes their inbox waiting for their validation email.
  5. Finally the user is able to click on the validation link.
  6. "Unknown session_id" error page 😢

I think the fix for this is to not delete the validation session during the UI Auth workflow and to delete them periodically (as we do with the UI auth sessions).

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions