Add grease attribute as part of new SCRAM updates
Nobody has claimed this yet.
- Dominant language
- Erlang
- Stars
- 152
- Forks
- 98
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
I talked to @weiss and so I know that you, @prefiks are already working on fixing bugs in the SCRAM code.
I want to suggest adding a new grease attribute (g=) as well. This will, like the grease for TLS defined in RFC 8701, force client developers to be RFC compliant and accept optional SCRAM attributes rather than crashing or doing other odd things like aborting authentication etc.
I already do the same in Monal (the g attribute) and that already catched a bug in the SCRAM implementation of ejabberd (I think Holger fixed it back then).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by locating the Erlang SCRAM parsing and serialization code and its existing authentication tests; determine how optional attributes are handled. Done means a random g attribute is emitted and accepted without breaking authentication, with coverage for clients that encounter it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100