Application service API authentication requires access_token to be in the query parameters

[jplatte]

There's an existing issue about this at matrix-org/matrix-spec-proposals#1424, but it got closed by matrix-org/matrix-spec-proposals#1534 which updates the wording about the usage of the client-server API for appservices, but not the wording about authentication in the appservice API itself. This seems like an oversight.

[turt2live]

Which direction of traffic is your concern in? Homeserver -> Appservice or Appservice -> Homeserver?

[jplatte]

I think this is Homeserver > Appservice? This is the section I'm talking about.

[turt2live]

Right, so matrix-org/matrix-spec-proposals#1424 was about the other direction. It is true that the only way homeservers can prove their identity to an appservice is through the query parameters, and this would require an MSC to change.

[Half-Shot]

This seems like it would be solved by matrix-org/matrix-spec-proposals#2832.

[turt2live]

Closing in favour of MSC, given it's on the edge of FCP.