diff --git a/develop/print.html b/develop/print.html index aed01ff53e..f7320771b7 100644 --- a/develop/print.html +++ b/develop/print.html @@ -1779,6 +1779,17 @@ dpkg -i matrix-synapse-py3_1.3.0+stretch1_amd64.deb +

Upgrading to v1.90.0

+

App service query parameter authorization is now a configuration option

+

Synapse v1.81.0 deprecated application service authorization via query parameters as this is +considered insecure - and from Synapse v1.71.0 forwards the application service token has also been sent via +the Authorization header], making the insecure +query parameter authorization redundant. Since removing the ability to continue to use query parameters could break +backwards compatibility it has now been put behind a configuration option, use_appservice_legacy_authorization.
+This option defaults to false, but can be activated by adding

+
use_appservice_legacy_authorization: true 
+
+

to your configuration.

Upgrading to v1.89.0

Removal of unspecced user property for /register

Application services can no longer call /register with a user property to create new users. @@ -6030,6 +6041,15 @@ Implicitly enables MAU tracking for application service users.

track_appservice_user_ips: true
 

+

use_appservice_legacy_authorization

+

Whether to send the application service access tokens via the access_token query parameter +per older versions of the Matrix specification. Defaults to false. Set to true to enable sending +access tokens via a query parameter.

+

**Enabling this option is considered insecure and is not recommended. **

+

Example configuration:

+
use_appservice_legacy_authorization: true 
+
+

macaroon_secret_key

A secret which is used to sign

+

Upgrading to v1.90.0

+

App service query parameter authorization is now a configuration option

+

Synapse v1.81.0 deprecated application service authorization via query parameters as this is +considered insecure - and from Synapse v1.71.0 forwards the application service token has also been sent via +the Authorization header], making the insecure +query parameter authorization redundant. Since removing the ability to continue to use query parameters could break +backwards compatibility it has now been put behind a configuration option, use_appservice_legacy_authorization.
+This option defaults to false, but can be activated by adding

+
use_appservice_legacy_authorization: true 
+
+

to your configuration.

Upgrading to v1.89.0

Removal of unspecced user property for /register

Application services can no longer call /register with a user property to create new users. diff --git a/develop/usage/configuration/config_documentation.html b/develop/usage/configuration/config_documentation.html index bfe85cd69d..1870ddedc5 100644 --- a/develop/usage/configuration/config_documentation.html +++ b/develop/usage/configuration/config_documentation.html @@ -2504,6 +2504,15 @@ Implicitly enables MAU tracking for application service users.

track_appservice_user_ips: true
 

+

use_appservice_legacy_authorization

+

Whether to send the application service access tokens via the access_token query parameter +per older versions of the Matrix specification. Defaults to false. Set to true to enable sending +access tokens via a query parameter.

+

**Enabling this option is considered insecure and is not recommended. **

+

Example configuration:

+
use_appservice_legacy_authorization: true 
+
+

macaroon_secret_key

A secret which is used to sign