Requested operation has changed during the UI authentication session - when trying to deactivate user with erasure

[Twi1ightSparkle]

Description

Deactivating an account with "Please forget all messages I have sent when my account is deactivated" checked does not work. You get the error "There was a problem communicating with the server. Please try again."

Network tab show 401 for deactivate, then 200, then 403.

The spinner thing goes on forever (at least a couple of hours before I gave up)

I tested this with an almost new account with very few messages. A customer also reported this, awaiting rageshake from them. My rageshake is linked

https://newvector.zammad.com/#ticket/zoom/3216
(customer email copy-pasted to my rageshake)

Steps to reproduce

• Create a matrix.org
• Settings
• Deactivate Account
• Check "Please forget all messages I have sent when my account is deactivated"
• Enter password
• Click Continue

Version information

Matrix.org, account deletion does work on my Modular server

• Homeserver: matrix.org

• Version: "1.12.4 (b=matrix-org-hotfixes,309e30bae)"

• Install method:

• Platform:

[Twi1ightSparkle]

Synapse logs added to rageshake

[anoadragon453]

So this is happening because Riot starts the User-Interactive Authentication Session with:

{"erase": false}

then, after the erase checkbox is checked and the user enters their password,

{
  "auth": {
    "session": "yyy",
    "type": "m.login.password",
    "user": "@xxx:matrix.org",
    "identifier": {
      "type": "m.id.user",
      "user": "@xxx:matrix.org"
    },
    "password": "xxx"
  },
  "erase": true
}

Now that erase is true, Synapse complains with:

{
  "errcode": "M_UNKNOWN",
  "error": "Requested operation has changed during the UI authentication session."
}

I'm not sure if this should be initially fixed from the Synapse or Riot side, but we'll need to inform clients that there's a potential breaking change if they were relying on changing the UIAA parameters mid-way through an authentication session, as Riot is doing here.

This check was introduced in #7068. Unfortunately, even after #7455 which relaxed the requirements a bit, this is still a problem in certain cases (but again, maybe a client problem rather than a server one).

This occurs on matrix.org as it is running v1.13.0rc - the check is not a part of v1.12.4.

[richvdh]

I feel pretty strongly that riot is at fault for (a) moving the goalposts mid-operation and (b) not giving the user a better error

[clokep]

See also #7452.

[clokep]

This should be fixed in 1.13.0 as of #7483.