Extend url template variables with device_id #78
Conversation
I mentioned the need for this parameter in the related [MSC 3891 ](matrix-org/matrix-spec-proposals#3819) which implements to device messages. They are relying on the device id to be available, but there is currently no way to access a device id from within a widget (Element Call does this but is cheating :P). Therefore [I propose to include the device id in the available parameters](matrix-org/matrix-spec-proposals#3819 (comment)). Signed-off-by: Oliver Sand <oliver.sand@nordeck.net>
Fox32
requested review from
dbkr and
alunturner
and removed request for
a team
|
In case this gets merged: It would be helpful to have a new release of the widget-api, so that I can continue the implementation in the matrix-react-sdk. |
|
I would be open to switch from |
Implement the [comment in MSC 3819](matrix-org/matrix-spec-proposals#3819 (comment)) which requests passing a device id to a widget. This is based on the previous work in the matrix-widget-api: matrix-org/matrix-widget-api#78 Signed-off-by: Oliver Sand <oliver.sand@nordeck.net>
Implement the [comment in MSC 3819](matrix-org/matrix-spec-proposals#3819 (comment)) which requests passing a device id to a widget. This is based on the previous work in the matrix-widget-api: matrix-org/matrix-widget-api#78 Signed-off-by: Oliver Sand <oliver.sand@nordeck.net>
|
Hello, firstly sorry for the delay in getting to this. I am really not familiar with this area of the codebase yet so I'll bow to @dbkr 's judgment on this, but commenting to try and get this moving for you. On the From my point of view I think this can be approved, I just haven't given it the tick due to my lack of knowledge here at the moment. |
|
I think a problem could be more the privacy perspective than the security. In general device ids are public information required to establish communication between users. Therefore they can be used to identify a user from the widget. From the privacy perspective I think it is fine to pass the device id to the widget, especially as the user is asked first before loading an untrusted widget for the first time. The user sees the list of potential data that is shared with the widget and can decide whether he trusts the widget. |
benparsons
added
the
A-Timesheet-1
There was a problem hiding this comment.
I think this seems fine. I also agree that matrix_device_id is probably better to match the other matrix related things rather than client specific settings, so it would probably be good to change that. We should obviously note this on the MSC too.
In terms of security, I think the only concern is widgets now being able to track what device they're used on for each user, although in practical terms they'd likely be able to do this in most cases anyway just with a user agent string or similar. I don't think it's worth having a separate permission for it.
Signed-off-by: Dominik Henneke <dominik.henneke@nordeck.net>
|
@dbkr I renamed the parameter to |
|
@dbkr, @t3chguy would it be possible to get a new release created? Then I could work on matrix-org/matrix-react-sdk#10209 so we get this finished. |
|
Thanks |
Implement the [comment in MSC 3819](matrix-org/matrix-spec-proposals#3819 (comment)) which requests passing a device id to a widget. This is based on the previous work in the matrix-widget-api: matrix-org/matrix-widget-api#78 Signed-off-by: Oliver Sand <oliver.sand@nordeck.net>
* Pass device id to widget Implement the [comment in MSC 3819](matrix-org/matrix-spec-proposals#3819 (comment)) which requests passing a device id to a widget. This is based on the previous work in the matrix-widget-api: matrix-org/matrix-widget-api#78 Signed-off-by: Oliver Sand <oliver.sand@nordeck.net> * Include all data that is shared in the permissions screen * Update matrix-widget-api to version 1.4.0 Signed-off-by: Dominik Henneke <dominik.henneke@nordeck.net> * Fix type and test Signed-off-by: Dominik Henneke <dominik.henneke@nordeck.net> --------- Signed-off-by: Oliver Sand <oliver.sand@nordeck.net> Signed-off-by: Dominik Henneke <dominik.henneke@nordeck.net> Co-authored-by: Dominik Henneke <dominik.henneke@nordeck.net>
I mentioned the need for this parameter in the related MSC 3891 which implements to device messages. They are relying on the device id to be available, but there is currently no way to access a device id from within a widget (Element Call does this but is cheating :P). Therefore I propose to include the device id in the available parameters.