`/keys/device_signing/upload` should not pass an empty auth object initially about element-web HOT 5 CLOSED

which is problematic as this leads to the assumption that the object contains a UIA session identifier. To reproduce one simply has to register a new account.

Where in the spec does it say to not do this?

The auth field and its contents are both optional which implies both are valid approaches.

from element-web.

which is problematic as this leads to the assumption that the object contains a UIA session identifier. To reproduce one simply has to register a new account.

Where in the spec does it say to not do this?

The auth field and its contents are both optional which implies both are valid approaches.

https://spec.matrix.org/v1.10/client-server-api/#user-interactive-api-in-the-rest-api

A client should first make a request with no auth parameter.

from element-web.

the verb used there is should not must so this is not against the spec inherently

from element-web.

Given the spec says should rather than must and that UIA is on the way out in favour of OIDC I'm not sure this will be resolved.

from element-web.

Given the spec says should rather than must and that UIA is on the way out in favour of OIDC I'm not sure this will be resolved.

I see, thanks for clarifying.

from element-web.