search

eclipse-vertx / vertx-sql-client

High performance reactive SQL Client written in Java
Apache License 2.0
894 stars 200 forks source link

Update to SCRAM 3.0 and support channel binding #1430

Closed jorsol closed 6 months ago

jorsol commented 7 months ago

Describe the feature

The vertx-pg-client should update to the latest SCRAM library 3.0 com.ongres.scram:scram-client:3.0 and add support to channel binding with PostgreSQL.

Use cases

Channel binding is a security technique used in encrypted connections to prevent Man-in-the-Middle (MitM) attacks. It works by creating a unique fingerprint of the communication channel based on details specific to that connection. This fingerprint helps ensure that the encrypted communication is happening on the intended channel and not a compromised one impersonated by an attacker.

Contribution

I'm volunteering to implement this feature (maintainer of the SCRAM 3.0 release).

jorsol commented 7 months ago

Since PostgreSQL 14+, the default value for password_encryption is scram-sha-256, this dependency should not be marked as optional to avoid recurring issues of failed authentication reports (due to the missing dependency).

So, should I remove the optional tag from the dependency declaration?