Web CSP blocks mozilla.org's homeserver discovery, so the mozilla.org login option on chat.lotusguild.org always says "Failed to connect" #21

New Issue

2026-10-04T20:33:35-04:00

jared commented

2026-10-04 20:33:35 -04:00

mozilla.org is in the web client's homeserverList (enabled on purpose in d6d1f5a2, "enable mozilla.org (OIDC/next-gen-auth homeserver)"). Choosing it on chat.lotusguild.org shows "Failed to connect. Either homeserver is unavailable at this moment or does not exist."

Why

https://mozilla.org/.well-known/matrix/client answers 301 → https://www.mozilla.org/.well-known/matrix/client.
The CSP's connect-src (cinny/nginx-security-headers.conf:15) lists https://mozilla.org https://mozilla.modular.im https://chat.mozilla.org but not https://www.mozilla.org, so the redirected discovery request is refused.
The fallback request to https://mozilla.org/_matrix/client/versions then fails CORS.

Console on the live site:

Connecting to 'https://www.mozilla.org/.well-known/matrix/client' violates the following Content Security Policy directive: "connect-src 'self' https://matrix.lotusguild.org …"

Fix: add https://www.mozilla.org to connect-src. After that, check the next-gen auth step on production: on a localhost dev origin the next step failed with Dynamic registration failed, shown to the user as a generic "Failed to start single sign-on. Please try again." That may only be the dev origin, but it's worth confirming once the CSP is fixed. If mozilla.org isn't actually wanted, remove it from homeserverList instead.

Related: #18 (TikTok connect-src). A short comment in the conf listing which feature needs each external host would help.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

`mozilla.org` is in the web client's `homeserverList` (enabled on purpose in d6d1f5a2, "enable mozilla.org (OIDC/next-gen-auth homeserver)"). Choosing it on chat.lotusguild.org shows **"Failed to connect. Either homeserver is unavailable at this moment or does not exist."** **Why** - `https://mozilla.org/.well-known/matrix/client` answers **301 → `https://www.mozilla.org/.well-known/matrix/client`**. - The CSP's `connect-src` (`cinny/nginx-security-headers.conf:15`) lists `https://mozilla.org https://mozilla.modular.im https://chat.mozilla.org` but **not `https://www.mozilla.org`**, so the redirected discovery request is refused. - The fallback request to `https://mozilla.org/_matrix/client/versions` then fails CORS. Console on the live site: ``` Connecting to 'https://www.mozilla.org/.well-known/matrix/client' violates the following Content Security Policy directive: "connect-src 'self' https://matrix.lotusguild.org …" ``` **Fix:** add `https://www.mozilla.org` to `connect-src`. After that, check the next-gen auth step on production: on a `localhost` dev origin the next step failed with `Dynamic registration failed`, shown to the user as a generic "Failed to start single sign-on. Please try again." That may only be the dev origin, but it's worth confirming once the CSP is fixed. If mozilla.org isn't actually wanted, remove it from `homeserverList` instead. Related: #18 (TikTok `connect-src`). A short comment in the conf listing which feature needs each external host would help. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._

jared added the infra priority: low bug labels 2026-10-04 20:33:35 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/matrix#21