processone / processone/xmpp

Add grease attribute as part of new SCRAM updates

Open
#109 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Erlang
Stars
152
Forks
98
Avg merge
3d 1h
Merged PRs (30d)
1

Description

I talked to @weiss and so I know that you, @prefiks are already working on fixing bugs in the SCRAM code.

I want to suggest adding a new grease attribute (g=) as well. This will, like the grease for TLS defined in RFC 8701, force client developers to be RFC compliant and accept optional SCRAM attributes rather than crashing or doing other odd things like aborting authentication etc.

I already do the same in Monal (the g attribute) and that already catched a bug in the SCRAM implementation of ejabberd (I think Holger fixed it back then).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file or test is named. Start by locating the Erlang SCRAM parsing and serialization code and its existing authentication tests; determine how optional attributes are handled. Done means a random g attribute is emitted and accepted without breaking authentication, with coverage for clients that encounter it.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang
Domain
authentication, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.