Authenticated Media & How to ship spec features
summary
Matrix switches media downloads to authenticated endpoints using access-token auth (implemented via Synapse and matrix-media-repo changes) and documents it as MSC 3916, splitting client and federation endpoints and requiring Synapse >=1.111. Web clients use service workers to add headers, mobile clients add a header, bridges proxy long‑lived URLs. Rollout enacts a media freeze so pre‑freeze uploads remain public; about 80% of requests are authenticated three weeks before the September 4 freeze and most users notice no break, though private browsers, guests and some widgets still need fixes.
AI-written summary · about
chapters (6)
- 0:00Introduction to Authenticated Media
- 10:08Understanding Matrix Spec Changes
- 20:29Evaluating Authentication Options
- 29:45Implementing the Chosen Solution
- 35:50Rollout Strategy and Challenges
- 41:10Production Readiness and Q&A
related talks
47mAuthentication and Authorization in the World of Media and Identity Providers
45mModern & secure adaptive streaming on the Web
42mDesigning Matrix: A Global Decentralised End-to-End Encrypted..
58mModern & secure adaptive streaming on the Web
31mIn a Perfect World: Why Media Sources Are a Hassle
46mModern & secure adaptive streaming on the Web
26mSecure Your MCP Servers with OAuth, JWT, SPIFFE and More
29mKeeping Agents in Check: Apollo MCP Authentication