This repository was archived by the owner on Apr 26, 2024. It is now read-only.
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Drop support for calling /_matrix/client/v3/rooms/{roomId}/invite without an id_access_token #13206
Description
The 3pid-invite version of POST /_matrix/client/v3/rooms/{roomId}/invite (spec) has id_access_token as a required parameter.
We currently accept requests without an id_access_token, and then call /_matrix/identity/api/v1/lookup, which was removed from the spec over a year ago (matrix-org/matrix-spec-proposals#2713).
Instead, we should simply reject any requests that do not pass an id_access_token.