Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug in SCRAM implementation #550

Open
tmolitor-stud-tu opened this issue Nov 26, 2023 · 2 comments
Open

Bug in SCRAM implementation #550

tmolitor-stud-tu opened this issue Nov 26, 2023 · 2 comments
Labels

Comments

@tmolitor-stud-tu
Copy link

Your SCRAM implementation is not RFC conformant: https://github.com/maranda/metronome/blob/development/util/sasl/scram.lua#L204

RFC 5802 section 5.1 (last bullet point) states:
Unknown optional extensions MUST be ignored upon receipt.
Only mandatory options should result in an error, if unsupported by one party. To quote the RFC again:

Mandatory extensions sent by one peer but not understood by the
other MUST cause authentication failure (the server SHOULD send
the "extensions-not-supported" server-error-value).
@Neustradamus
Copy link

@tmolitor-stud-tu: To follow this ticket.

@tmolitor-stud-tu
Copy link
Author

@Neustradamus do you know that you can follow an issue by pressing the "Subscribe button" of the issue?

@maranda maranda added the bug label Dec 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants