From 4febfe47f03a97578e186fa6cae28c29ad8327cb Mon Sep 17 00:00:00 2001
From: Richard van der Hoff <richard@matrix.org>
Date: Wed, 30 Nov 2016 07:36:32 +0000
Subject: [PATCH] Comments
Update comments in verify_macaroon
---
synapse/api/auth.py | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/synapse/api/auth.py b/synapse/api/auth.py
index 77ff55cddf..b8c2917f21 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -790,9 +790,6 @@ class Auth(object):
type_string(str): The kind of token required (e.g. "access", "refresh",
"delete_pusher")
verify_expiry(bool): Whether to verify whether the macaroon has expired.
- This should really always be True, but there exist access tokens
- in the wild which expire when they should not, so we can't
- enforce expiry yet.
user_id (str): The user_id required
"""
v = pymacaroons.Verifier()
@@ -805,6 +802,15 @@ class Auth(object):
v.satisfy_exact("type = " + type_string)
v.satisfy_exact("user_id = %s" % user_id)
v.satisfy_exact("guest = true")
+
+ # verify_expiry should really always be True, but there exist access
+ # tokens in the wild which expire when they should not, so we can't
+ # enforce expiry yet (so we have to allow any caveat starting with
+ # 'time < ' in access tokens).
+ #
+ # On the other hand, short-term login tokens (as used by CAS login, for
+ # example) have an expiry time which we do want to enforce.
+
if verify_expiry:
v.satisfy_general(self._verify_expiry)
else:
--
GitLab