Repository: matrix-org/synapse

Issue:
Deprecate and then remove web_client_location
Having Synapse host a web client is a security risk, as mentioned here: https://github.com/matrix-org/synapse#security-note and I doubt many people are still using it. I think you should deprecate the `web_client_location` option in `homeserver.yaml`.

It would also close at least one issue: https://github.com/matrix-org/synapse/issues/1250
Synapse responds with a 404 with HTML content for unknown URL prefixes
See https://github.com/vector-im/element-web/issues/19738#issuecomment-996804209 for some background, but if you request an endpoint for Synapse that doesn't have a prefix registered (see [here](https://github.com/matrix-org/synapse/blob/71f9966f2790c6b24281bb9f109bff28ff05d962/synapse/app/homeserver.py#L185-L196)) then Synapse responds with a 404 including HTML content (the default Twisted 404 handler).

This wasn't an issue when adding new `/unstable` or `/r0` endpoints since the prefix was registered, but the `/hierarchy` endpoint is the first `/v1` endpoint we had. This will also bite us once we need to rev an endpoint to `/v2` (or `/v4`) since neither of those are registered right now.


Discussion:
For sure the option to point it at a path on disk and have it be served from `/_matrix/client` should be removed. It is possible that people are relying on the redirect to another URL option but I wouldn't think very many people would be using it.

I'm not sure if this would be considered an unspecced API https://github.com/matrix-org/synapse/issues/8334. As far as I know nothing in the spec mentions hosting a client at `/_matrix/client`.
Thanks for filing this! I kept meaning to file an issue about removing this... leaving the redirect seems safe, but would be simpler to remove it altogether. 🤷 
Is the redirect supposed to work? It can be useful to have a way to point users to the preferred web-client-instance that their homeserver-admin specified.

I would have assumed that https://matrix-client.matrix.org/_matrix/client/ redirects to https://app.element.io but it gives a 404.
No solution mentioned in this discussion has been implemented yet I'm afraid.
#11763 
We had a discussion about this today in #synapse-dev with the conclusion:

* we deprecate *non-redirect* `web_client_location`, and the `webclient` listener, with intention to remove support for it in a release or two.
* in the meantime, we can also make `/` redirect directly to the `web_client_location` if it's absolute, rather than bouncing via `/_matrix/client`
> then Synapse responds with a 404 including HTML content (the default Twisted 404 handler).

and without an ACAO header so browser-based clients can't even read that its a 404 as the browser just gives them a generic failure due to CORS.
This was reverted due to poor interaction with a legacy feature.

Resolving patch:
diff --git a/synapse/app/homeserver.py b/synapse/app/homeserver.py
--- a/synapse/app/homeserver.py
+++ b/synapse/app/homeserver.py
@@ -26,6 +26,7 @@
 import synapse.config.logger
 from synapse import events
 from synapse.api.urls import (
+    CLIENT_API_PREFIX,
     FEDERATION_PREFIX,
     LEGACY_MEDIA_PREFIX,
     MEDIA_R0_PREFIX,
@@ -195,13 +196,7 @@ def _configure_named_resource(
 
             resources.update(
                 {
-                    "/_matrix/client/api/v1": client_resource,
-                    "/_matrix/client/r0": client_resource,
-                    "/_matrix/client/v1": client_resource,
-                    "/_matrix/client/v3": client_resource,
-                    "/_matrix/client/unstable": client_resource,
-                    "/_matrix/client/v2_alpha": client_resource,
-                    "/_matrix/client/versions": client_resource,
+                    CLIENT_API_PREFIX: client_resource,
                     "/.well-known": well_known_resource(self),
                     "/_synapse/admin": AdminRestResource(self),
                     **build_synapse_client_resource_tree(self),


Test patch: