Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent AUTHENTICATE without matching AUTH=#{mechanism} capability #48

Closed
1 of 2 tasks
Tracked by #12 ...
nevans opened this issue Nov 23, 2021 · 1 comment
Closed
1 of 2 tasks
Tracked by #12 ...
Labels
IMAP4rev1 Requirement for IMAP4rev1, RFC3501 SASL 🔒 Authentication and authentication mechanisms

Comments

@nevans
Copy link
Collaborator

nevans commented Nov 23, 2021

e.g. most servers disallow AUTH=PLAIN unless TLS is established. See also #32 for LOGINDISABLED.

We can provide an opt-out via kwarg to authenticate.

Depends on:

@nevans nevans changed the title honor server capabilities (many servers disallow unless TLS is established) honor LOGINDISABLED and AUTH=mechanism capabilities Nov 23, 2021
@nevans nevans changed the title honor LOGINDISABLED and AUTH=mechanism capabilities honor AUTH=mechanism capabilities Nov 23, 2021
@nevans nevans changed the title honor AUTH=mechanism capabilities Prevent SASL mechanisms that aren't listed in server's AUTH= capabilities Nov 23, 2021
@nevans nevans added SASL 🔒 Authentication and authentication mechanisms IMAP4rev1 Requirement for IMAP4rev1, RFC3501 labels Feb 12, 2023
@nevans nevans changed the title Prevent SASL mechanisms that aren't listed in server's AUTH= capabilities Prevent AUTHENTICATE without matching AUTH={mechanism} capability Feb 17, 2023
@nevans nevans changed the title Prevent AUTHENTICATE without matching AUTH={mechanism} capability Prevent AUTHENTICATE without matching AUTH=#{mechanism} capability Feb 17, 2023
@nevans
Copy link
Collaborator Author

nevans commented Sep 25, 2023

While working on SASL-IR, I looked more closely at the RFCs. And the specs do not treat AUTH={mechanism} as identical to LOGINDISABLED:

  • LOGINDISABLED is a negative requirement on the client (MUST NOT login)
  • AUTH={mechanism} is a positive suggestion to the server (SHOULD advertise allowed mechanisms).

SASL has an important benefit over login: we can ask server if it's okay to proceed prior to sending any sensitive data. As such, I made the decision in #90 to still support calling authenticate with any mechanism without any warnings, however this has the important caveat that the initial response is only sent when the mechanism is advertised.

@nevans nevans closed this as completed Sep 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
IMAP4rev1 Requirement for IMAP4rev1, RFC3501 SASL 🔒 Authentication and authentication mechanisms
Development

No branches or pull requests

1 participant