From 219e8d2e1e3caa401f0cad5357719453c7698f7e Mon Sep 17 00:00:00 2001 From: Bardi Harborow Date: Wed, 4 Nov 2026 21:20:25 +1100 Subject: [PATCH] fix: Return M_UNKNOWN_DEVICE for unknown masqueraded appservice devices When an appservice masqueraded as a device_id that does not exist for the user, we returned 403 M_FORBIDDEN. The spec requires 400 M_UNKNOWN_DEVICE. --- changelog.d/2451.bugfix.3.md | 1 + src/api/router/auth.rs | 5 +---- 2 files changed, 2 insertions(+), 4 deletions(-) create mode 100644 changelog.d/2451.bugfix.3.md diff --git a/changelog.d/2451.bugfix.3.md b/changelog.d/2451.bugfix.3.md new file mode 100644 index 000000000..f75d21824 --- /dev/null +++ b/changelog.d/2451.bugfix.3.md @@ -0,0 +1 @@ +Appservices masquerading as a device that does not exist now receive 400 `M_UNKNOWN_DEVICE` as required by the spec, instead of 403 `M_FORBIDDEN`. diff --git a/src/api/router/auth.rs b/src/api/router/auth.rs index e731245df..af19fb03b 100644 --- a/src/api/router/auth.rs +++ b/src/api/router/auth.rs @@ -379,10 +379,7 @@ async fn check_access_token( .await .is_err() { - return Err!(Request(Forbidden( - "Device does not exist for user or appservice cannot masquerade as this \ - device." - ))); + return Err!(Request(UnknownDevice("Device does not exist for this user."))); } Some(device_id.to_owned())