`forbidden_remote_server_names` no longer blocks all requests #1738

New issue

Closed

opened 2026-05-06 00:39:16 +00:00 by 31a · 1 comment

31a commented

2026-05-06 00:39:16 +00:00

Contributor

all outgoing requests are still blocked, and some incoming requests are blocked, however incoming PDUs and EDUs from forbidden servers are accepted, where they previously were not.

exact test used:

run server A from main (and latest to compare)
user from server B invites user from server A to a room
server A marks server B as forbidden
user from server B invites user from server A to another room
- fails both on latest and on main
user of A sends a message or typing notification in the shared room
- not delivered to server B on both latest and main
user of B sends a message or typing notification in the shared room
- not delivered to server A on latest (unless a third user triggers backfill)
- delivered to server A immediately on main

this was introduced at some point between e44ac230 (behaves like main) and 1cc9dbf2 (behaves like latest)

all outgoing requests are still blocked, and some incoming requests are blocked, however incoming PDUs and EDUs from forbidden servers are accepted, where they previously were not. exact test used: - run server A from `main` (and `latest` to compare) - user from server B invites user from server A to a room - server A marks server B as forbidden - user from server B invites user from server A to another room - fails both on latest and on main - user of A sends a message or typing notification in the shared room - not delivered to server B on both latest and main - user of B sends a message or typing notification in the shared room - not delivered to server A on latest (unless a third user triggers backfill) - delivered to server A immediately on main this was introduced at some point between e44ac230 (behaves like `main`) and 1cc9dbf2 (behaves like latest)

nex added the

labels

2026-05-06 02:43:59 +00:00

31a commented

2026-05-06 07:34:38 +00:00

Author

Contributor

the cause seems to be that 0c7abd79 dropped a check for forbidden servers from src/api/router/auth.rs

no other instances of that check seem to have been changed

the cause seems to be that 0c7abd79 dropped a check for forbidden servers from `src/api/router/auth.rs` no other instances of that check seem to have been changed