See MSC4126 for details on query string authentication and the prerequisite deprecation.
Query string authentication becomes removed from the Client-Server API and Identity Service API.
The prior deprecation required by the deprecation policy is described by MSC4126.
As a process note, it was considered to bundle the deprecation and removal into MSC4126 instead of
having two separate MSCs, breaking the deprecation policy slightly, though this introduces consequences
which are, in the author's opinion, undesirable. Specifically, the spec release changelog for the
deprecation would say "as per MSC4126" and imply the MSC being moved to the merged
state, however the second half of the MSC (the feature removal) would not have landed yet. This would
leave the MSC stuck in an awkward spec-pr-missing state because half of it had not been written up
or landed yet. To maintain a clearer changelog, ease process considerations, and give clients another
opportunity to object to the removal, the two MSC approach required by the deprecation policy is best.
See MSC4126.
See MSC4126.
More of a process note, during drafting of this proposal the author considered combining the deprecation and removal into a single MSC, against the advice of the deprecation policy. The aim was to reduce process burden and more quickly get the security risk removed from the specification, though merging both operations into a single MSC potentially makes the spec release changelog unclear and leaves the MSC in an awkward released-but-not-merged state. To avoid figuring out how to navigate the process states, increasing the process burden rather than decreasing it, the deprecation policy's two MSC requirement has been followed here. However, there are still other process efficiencies which can take place - see the "Dependencies" section of this MSC for details.
See MSC4126.
This proposal cannot feasibly have an unstable prefix. Clients are already discouraged from using
query string authentication and should switch to Authorization as soon as possible, regardless of
this MSC.
See MSC4126 for related details.
MSC4126 must be released in the specification before this proposal can be merged, though this MSC may progress through Final Comment Period concurrent to MSC4126 if desirable.