From db0b083a3e21926386779d9fd006ea3a70fcfc7a Mon Sep 17 00:00:00 2001 From: Jared Vititoe Date: Sat, 23 May 2026 22:25:13 -0400 Subject: [PATCH] fix: prevent allow_redirect=true on media URLs; fallback on 400 too Synapse's thumbnail endpoint returns 400 Bad Request when the allow_redirect=true query parameter is present (added by matrix-js-sdk 41.x for authenticated media). Default allowRedirects to false in our mxcUrlToHttp wrapper so the parameter is never appended. Also extend the downloadMedia legacy-URL fallback to cover 400 in addition to 401, catching any encrypted-media fetches that still carry the old URL shape after a cache refresh. Co-Authored-By: Claude Sonnet 4.6 --- src/app/utils/matrix.ts | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/app/utils/matrix.ts b/src/app/utils/matrix.ts index dd6ab8fc1..dd15bd4c1 100644 --- a/src/app/utils/matrix.ts +++ b/src/app/utils/matrix.ts @@ -284,7 +284,8 @@ export const mxcUrlToHttp = ( height?: number, resizeMethod?: string, allowDirectLinks?: boolean, - allowRedirects?: boolean, + // Synapse's thumbnail endpoint returns 400 for allow_redirect=true; keep false everywhere. + allowRedirects = false, ): string | null => mx.mxcUrlToHttp( mxcUrl, @@ -301,11 +302,12 @@ export const downloadMedia = async (src: string): Promise => { const res = await fetch(src, { method: 'GET' }); if (res.ok) return res.blob(); - // On 401 fall back to the legacy unauthenticated media path. - // This covers the race where the SW session isn't set yet, or when matrix-js-sdk - // appends ?allow_redirect=true and Synapse strips auth on the redirect hop. + // On 401/400 fall back to the legacy unauthenticated media path. + // 401: SW session missing (race on first load or after SW restart). + // 400: allow_redirect=true on a URL that was constructed before this fix was deployed; + // Synapse's thumbnail endpoint rejects that parameter with 400. // Requires allow_public_access_to_media_repo: true on the homeserver. - if (res.status === 401) { + if (res.status === 401 || res.status === 400) { const legacyUrl = src .replace('/_matrix/client/v1/media/download/', '/_matrix/media/v3/download/') .replace('/_matrix/client/v1/media/thumbnail/', '/_matrix/media/v3/thumbnail/');