"Forgot password" broken by element-web upgrade to v1.11.12

[estellecomment]

"Forgot password" works on localhost with v4.1.0_1.11.10
It is broken on localhost at commit 5d44525

[estellecomment]

Latest commits, since tag tchap-4.1.0_1.11.10

• 5d44525 2022-11-15 Merge pull request Customise rageshake reports to add user email #284 from tchapgouv/customize-rageshake
• 12c1ea7 2022-11-14 Merge pull request 185: Add Save your Tchap Keys before logging out #291 from tchapgouv/185-logging-out-no-warning-on-keys-backup
• bf42ea3 2022-11-09 Merge pull request Get version from package json for all builds #298 from tchapgouv/get-version-from-package-json
• 39ba458 2022-11-08 Merge pull request Upgrade/element web v1.11.12 #285 from tchapgouv/upgrade/element-web-v1.11.12
• c1b522c 2022-11-08 Merge pull request Linter fix : deprecation warning for enzyme #294 from tchapgouv/fix-linter-again
• 78e9068 2022-11-07 Merge pull request Fix linter #293 from tchapgouv/fix-linter
• 2f9d72e 2022-11-07 (tag: tchap-4.1.0_1.11.10) Merge pull request add a handler to refresh client store when migrating from v2 #287 from tchapgouv/278-my-contacts-can-not-uncrypt-my-messages

The most suspicious is the merge of element-web-v1.11.12.

[estellecomment]

Yup! element-web merge broke it.
c1b522c works (just before element-web upgrade)
39ba458 is broken (element-web upgrade)

Edit : relevent PRs to see diffs :
Tchap-web : https://github.com/tchapgouv/tchap-web-v4/pull/285/files
React-sdk : https://github.com/tchapgouv/matrix-react-sdk-fork/pull/3/files
Js-sdk : https://github.com/betagouv/matrix-js-sdk-fork/pull/1/files#

[estellecomment]

OLM versions :

element-web 1.11.10 : olm-3.2.12
element-web 1.11.12 : olm-3.2.12

react-sdk 3.58.1 : olm-3.2.8
react-sdk 3.59.0 : olm-3.2.8

js-sdk 20.1.0 : olm-3.2.12
js-sdk 21.0.0 : olm-3.2.13 -> mismatch with element-web ?

But element-web 1.11.14 with olm-3.2.12 has a working password reset (tested on app.element.io). So probably not.

[estellecomment]

I don't see a difference in the requests and responses sent in the two cases.
POST /matrix/client/r0/account/password/email/requestToken
POST /_matrix/client/r0/account/password

The error we get is 401
{"errcode":"M_UNKNOWN_TOKEN","error":"Invalid macaroon passed.","soft_logout":false}
From googling around, it's a problem with the token ?

[odelcroi]

The error happens because a "Authorization Bearer undefined" is sent to the server when hitting the /password endpoint.
POST /_matrix/client/r0/account/password
The backend does not like it then return a 401 invalid macaroon

[estellecomment]

Temporary PR : https://github.com/tchapgouv/tchap-web-v4/pull/314/files
Before merging it, it would be good to understand why this is happening.

[estellecomment]

Problem is fixed in 1.11.13, the bad header is not present any more and the forgot password flow works.
So we can either apply the patch or upgrade to 1.11.13.