From 89d1d9e694c3edabc9a1f17a5d0a2386b9384bb6 Mon Sep 17 00:00:00 2001 From: Travis Ralston Date: Thu, 5 Sep 2024 13:57:57 -0600 Subject: [PATCH] MSC: Allowing guests to access uploaded media --- proposals/4189-guest-access-media-routes.md | 53 +++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 proposals/4189-guest-access-media-routes.md diff --git a/proposals/4189-guest-access-media-routes.md b/proposals/4189-guest-access-media-routes.md new file mode 100644 index 0000000000..df78a11676 --- /dev/null +++ b/proposals/4189-guest-access-media-routes.md @@ -0,0 +1,53 @@ +# MSC4189: Allowing guests to access uploaded media + +[MSC3916](https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/3916-authentication-for-media.md) +introduced new endpoints which require clients to provide a valid access token in order to access +media. The MSC failed to specify [guest access](https://spec.matrix.org/v1.11/client-server-api/#guest-access) +requirements for the new endpoints. + +This MSC specifies the missing guest access requirements on the new endpoints. + +## Proposal + +The following endpoints explicitly permit guest access, joining the +[list of other endpoints](https://spec.matrix.org/v1.11/client-server-api/#client-behaviour-13) +already in the specification: + +* [`GET /_matrix/client/v1/media/download/{serverName}/{mediaId}`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediadownloadservernamemediaid) +* [`GET /_matrix/client/v1/media/download/{serverName}/{mediaId}/{fileName}`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediadownloadservernamemediaidfilename) +* [`GET /_matrix/client/v1/media/thumbnail/{serverName}/{mediaId}`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediathumbnailservernamemediaid) + +The rationale for the above endpoints is that being able to see events without the associated media +isn't very useful. + +For clarity, the following endpoints are *not* added to the guest access list, as their prior (now +deprecated) versions are not already included. A future MSC may change this with sufficient rationale. +Note that guests cannot currently *upload* files, but can send messages/events. + +* [`GET /_matrix/client/v1/media/config`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediaconfig) +* [`GET /_matrix/client/v1/media/preview_url`](https://spec.matrix.org/v1.11/client-server-api/#get_matrixclientv1mediapreview_url) + +## Potential issues + +This MSC fixes an issue where guests cannot download images/files. + +## Alternatives + +None applicable. + +## Security considerations + +This MSC does not materially increase the threat profile for guests: guests could already download +media using the unauthenticated endpoints. + +## Unstable prefix + +Prefixed endpoints are excessive for this MSC. Implementations can enable guest access on the existing +endpoints safely, or continue to respond with "guest access forbidden" errors. No `/versions` flag +is specified for feature detection: clients with guest access tokens should expect failure until a +server advertises a specification version containing this MSC. Clients should continue trying to make +requests for the best user experience. + +## Dependencies + +This MSC has no dependencies.