Interactive auth chooses the first flow it sees, not the one it supports

[spantaleev]

Steps to reproduce

1. Add at least one password provider module to Synapse which supports a custom login type (an example is matrix-synapse-shared-secret-auth, which defines a com.devture.shared_secret_auth login type meant to be used like this). You don't even need to use the custom password provider - it just needs to be registered with Synapse. You can also register a custom module providing a my.login_type like this example in the Synapse docs
2. Use Element and try to delete one of your existing devices from the Security & Privacy dialog
3. An Authentication popup appears with a Start authentication button
4. Clicking Start authentication leads to https://matrix.DOMAIN/_matrix/client/r0/auth/com.devture.shared_secret_auth/fallback/web?session=.... (note the com.devture.shared_secret_auth part of the URL)
5. This page renders: {"errcode":"M_UNKNOWN","error":"Unknown auth stage type"} and you can't proceed

Outcome

What did you expect?

I expect interactive auth to work using a supported authentication method (m.login.password, etc.), despite various password provider modules advertising other (unknown to Element) login methods.

What happened instead?

Upon pressing the Delete devices button in Element, a Request to POST /_matrix/client/r0/delete_devices got sent, which received a response like this:

{
    "session":"...",
    "flows":[
        {"stages":["com.devture.shared_secret_auth"]},
        {"stages":["m.login.password"]}
    ],
    "params":{}
}

It seems like Element picked the first flow it saw (com.devture.shared_secret_auth in this case), instead of the flow it understands.

Operating system

No response

Browser information

No response

URL for webapp

No response

Application version

1.9.3

Homeserver

No response

Will you send logs?

No

[spantaleev]

Right now (Synapse v1.53.0), I'm seeing the opposite.

The m.login.password flow is first in the flows list reported by POST /_matrix/client/r0/delete_devices, which effectively works around this problem.

Perhaps something changed in recent Synapse versions, which fixed this problem (by coincidence or not)?