Repository navigation
Profile endpoint rate limit - #20218
Merged
erikjohnston merged 13 commits intoSep 18, 2026
Merged
Conversation
Resolve the optional requester in its own helper and make the combined function's name reflect that it authenticates as well as rate limits. Use has_access_token to detect unauthenticated requests, matching the delayed events management rate limiter.
…-rate-limit # Conflicts: # synapse/rest/client/profile.py
erikjohnston
requested changes
Sep 16, 2026
erikjohnston
left a comment
erikjohnston
left a comment
Member
There was a problem hiding this comment.
Broadly looks good, though I think we can maybe clean it up a tad.
Profile lookups only require authentication when `require_auth_for_profile_requests` is set, which previously meant checking that option in the helper and again in each servlet. Add a generic `get_optional_user_by_req` to the auth classes, which returns None when no access token is present, and use it so the option is consulted once.
Use `get_user_by_req` when authentication is required and the optional variant only otherwise, rather than always authenticating optionally and raising on a missing token. Guests are then rejected when `require_auth_for_profile_requests` is set, as before this branch, and the option is still only consulted once.
3 tasks done
Since we're using a `Protocol` to define the interface, declaring a dummy `get_user_by_req` on `BaseAuth` may make it match the `Auth` protcol when it shouldn't. It also makes it easy to forget to implement `get_user_by_req` on new subclasses. We use `abc` to ensure that a) `BaseAuth` can't be instansiated directly, and b) any concrete subclasses does implement the `get_user_by_req` method.
erikjohnston
approved these changes
Sep 18, 2026
Member
|
Thanks! |
barodeur
added a commit
that referenced
this pull request
Sep 23, 2026
…uire_auth_for_profile_requests` (#20231) As I was working on #20218, I noticed what seemed to be an illegal configuration of synapse. - `require_auth_for_profile_requests`: blocks profile requests unless authenticated - `limit_profile_requests_to_users_who_share_rooms`: blocks profile requests unless authenticated user share a room with requested user This, I think, should be an illegal config: ``` require_auth_for_profile_requests = false limit_profile_requests_to_users_who_share_rooms = true ``` As of now, with such a config the shared-room check is never applied: a profile can be requested anonymously, and also by an authenticated user who doesn't share a room. ### Pull Request Checklist <!-- Please read https://element-hq.github.io/synapse/latest/development/contributing_guide.html before submitting your pull request --> * [x] Pull request is based on the develop branch * [x] Pull request includes a [changelog file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog). The entry should: - Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from `EventStore` to `EventWorkerStore`.". - Use markdown where necessary, mostly for `code blocks`. - End with either a period (.) or an exclamation mark (!). - Start with a capital letter. - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry. * [x] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters)) --------- Co-authored-by: Olivier 'reivilibre' <oliverw@element.io>
2 of 3 tasks
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
Oct 13, 2026
Tested on NetBSD 10 amd64 with 2026Q3 environment.
Packaging changes:
- use maturin's tool.mk, to get the part that respects MAKE_JOBS
- patch mio, which had a pre-NetBSD10 type for kevent.udata, a
latent bug apparently exposed by a new libc crate, but fixable on
its own merits by code inspection.
# Synapse 1.162.0 (2026-09-29)
## Features
- Raise default room version to "12". Contributed by @jason-famedly @famedly. ([\#20130](element-hq/synapse#20130))
- Limit the number of end-to-end encryption one-time keys stored per device to 500 per algorithm, rejecting uploads which would exceed the limit with a `400 Bad Request`. ([\#20162](element-hq/synapse#20162))
- Add support for configuring a `username` for Redis connections, for Redis 6+ ACL authentication. ([\#20187](element-hq/synapse#20187))
- Add a rate limit on the client profile lookup endpoints, configurable via `rc_profile`. ([\#20218](element-hq/synapse#20218))
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
Oct 21, 2026
Tested on NetBSD 10 amd64 with 2026Q3 environment.
Packaging changes:
- use maturin's tool.mk, to get the part that respects MAKE_JOBS
- patch mio, which had a pre-NetBSD10 type for kevent.udata, a
latent bug apparently exposed by a new libc crate, but fixable on
its own merits by code inspection.
# Synapse 1.162.0 (2026-09-29)
## Features
- Raise default room version to "12". Contributed by @jason-famedly @famedly. ([\#20130](element-hq/synapse#20130))
- Limit the number of end-to-end encryption one-time keys stored per device to 500 per algorithm, rejecting uploads which would exceed the limit with a `400 Bad Request`. ([\#20162](element-hq/synapse#20162))
- Add support for configuring a `username` for Redis connections, for Redis 6+ ACL authentication. ([\#20187](element-hq/synapse#20187))
- Add a rate limit on the client profile lookup endpoints, configurable via `rc_profile`. ([\#20218](element-hq/synapse#20218))
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
Oct 25, 2026
Tested on NetBSD 10 amd64 with 2026Q3 environment. Packaging changes: - drop mio patch because synapse uses newer mio with a fix # Synapse 1.163.1 (2026-10-22) ## Internal Changes - Update `certifi` to `2026.10.19` to address [GHSA-6q48-6c7w-9gw2](GHSA-6q48-6c7w-9gw2). This only affects TLS connections made by the Sentry SDK when `sentry` is configured, SAML, and a couple utility scripts; federation and Synapse's other outbound HTTP requests use the system trust store. ([\#20387](element-hq/synapse#20387)) - Bump `rustls-webpki` to `0.103.16` to actively distrust [compromised eMudhra intermediate CA certificates](https://emudhra.we-have-a-problem.com/). ([\#20392](element-hq/synapse#20392)) # Synapse 1.163.0 (2026-10-14) ## Features - Advertise support for Matrix v1.14. Contributed by @famedly. ([\#20137](element-hq/synapse#20137)) - Advertise support for Matrix v1.15. ([\#20286](element-hq/synapse#20286)) - Catch up [MSC4354 Sticky Events](matrix-org/matrix-spec-proposals#4354) to remote homeservers that have missed them. ([\#20165](element-hq/synapse#20165)) - Add push rules for [MSC4075](matrix-org/matrix-spec-proposals#4075): MatrixRTC invites and notifications. ([\#20227](element-hq/synapse#20227)) - Make the task scheduler concurrency configurable via `task_scheduler.max_concurrent_tasks`, defaulting to 5. ([\#20230](element-hq/synapse#20230)) - Cancel a user's scheduled [MSC4140](matrix-org/matrix-spec-proposals#4140) delayed events when their account is deactivated. ([\#20247](element-hq/synapse#20247)) ## Deprecations and Removals - Remove the ability to send state events that are sticky, as this feature was removed from [MSC4354: Sticky Events](matrix-org/matrix-spec-proposals#4354). ([\#20256](element-hq/synapse#20256)) # Synapse 1.162.0 (2026-09-29) ## Features - Raise default room version to "12". Contributed by @jason-famedly @famedly. ([\#20130](element-hq/synapse#20130)) - Limit the number of end-to-end encryption one-time keys stored per device to 500 per algorithm, rejecting uploads which would exceed the limit with a `400 Bad Request`. ([\#20162](element-hq/synapse#20162)) - Add support for configuring a `username` for Redis connections, for Redis 6+ ACL authentication. ([\#20187](element-hq/synapse#20187)) - Add a rate limit on the client profile lookup endpoints, configurable via `rc_profile`. ([\#20218](element-hq/synapse#20218))
82 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This provides configurable (via
rc_profile) rate limits for profile endpoints:GET /profile/{username}GET /profile/{username}/{keyName}including (displayname&avatar_url)Pull Request Checklist
EventStoretoEventWorkerStore.".code blocks.