search

ircv3 / ircv3-specifications

IRCv3 specifications | Roadmap: https://git.io/IRCv3-Roadmap | Code of conduct: http://ircv3.net/conduct.html
http://ircv3.net/
778 stars 79 forks source link

sasl: spec recommendations breaks single roundtrip connection registration #536

Open emersion opened 6 months ago

emersion commented 6 months ago

Clients want to minimize the number of roundtrips used to connect to an IRC server, especially on flaky connections such as mobile phones/hotspots. To this end, some clients (including gamja, goguma) send multiple commands in a single burst without waiting for the server reply.

The following commands are sent in a single burst:

AUTHENTICATE PLAIN
AUTHENTICATE <base64>
CAP END

The spec says:

If the client completes registration (with CAP END, NICK, USER and any other necessary messages) while the SASL authentication is still in progress, the server SHOULD abort it and send a 906 numeric, then register the client without authentication.

Ref https://github.com/inspircd/inspircd/issues/2086

grawity commented 6 months ago

A few years ago I wanted to specify an equivalent of IMAP's SASL-IR cap, which allows a single AUTHENTICATE <mech> <1st-response> command, but was shot down because "nobody would ever need that".

emersion commented 6 months ago

Ah, seems like you've had the same idea as https://github.com/ircv3/ircv3-specifications/pull/520. While this helps a bit, it still wouldn't prevent the server from processing the CAP END before the single AUTHENTICATE command completes.

slingamn commented 6 months ago

I was not aware of this recommendation and would support deleting it.

SadieCat commented 6 months ago

I'd support weakening the SHOULD to a MAY for clients using sasl-3.2 which would keep compatibility for clients that expect sasl-3.1 behaviour.