App should return 409 when private key already exists about end_to_end_encryption

[tobiasKaminsky]

About which endpoint do you talk about?
Store API says:
409 conflict: if a private key for the user already exists

[ardevd]

Ah, my bad. I overlooked that one. I realize now that perhaps the issue was with the Android app but I tried the following:

1. Post a new keypair to the E2E app.
2. Delete the public key
3. Re-install the Android app. It will then prompt you to generate a new pass phrase. After which it posts the keypair to the server again where the E2E app seemingly ignores the private key (seemingly because it already exists) and then accepts the public key. The end result is a keypair mismatch.

Hope this made sense.

From the API point of view it makes sense that the behavior is this way. But the end-result is flawed. Im thinking the Android app should probably not upload the public key if the private key was rejected.

[ardevd]

UPDATE: Looking through the Android app code I see that it does in fact check the return value when posting the private key. That means that the server seemingly returned 200 OK even though a private key already existed.

[tobiasKaminsky]

We first generate/use the public key and only if the public was stored correctly on server, we continue with private key.
Isn't this solved via nextcloud/android#2153?

[ardevd]

Yes, though in my testing the server returned 200 OK even though a private key already existed. I will do some more testing and see if I can reproduce the issue.

[georgehrke]

@ardevd Were you ever able to reproduce the issue?

[no-response]

This issue has been automatically closed because there has been no response to our request for more information from the original author. With only the information that is currently in the issue, we don't have enough information to take action. Please reach out if you have or find the answers we need so that we can investigate further.

[no-response]

This issue has been automatically closed because there has been no response to our request for more information from the original author. With only the information that is currently in the issue, we don't have enough information to take action. Please reach out if you have or find the answers we need so that we can investigate further.