search

prose-im / prose-app-web

Prose Web application. XMPP client for team messaging.
https://prose.org/downloads
Mozilla Public License 2.0
19 stars 2 forks source link

Prose doesn't authenticate against servers implementing XEP-0474 (SASL SCRAM Downgrade Protection) #106

Closed nesium closed 3 weeks ago

nesium commented 3 weeks ago

Moved from https://github.com/prose-im/prose-core-client/issues/87 because prose-app-web uses the strophe.js dependency.

More on the subject of how it may affect other clients be read here: https://www.process-one.net/blog/ejabberd-24-02/#converse

In short, prose fails to authenticate against recent ejabberd or prosody server whenever disable_sasl_scram_downgrade_protection: true is set (ejabberd) or with https://modules.prosody.im/mod_sasl_ssdp.html (prosody).

I haven't had too deep of a look, but presumably this was fixed in this PR: https://github.com/strophe/strophejs/pull/698?

rom1dep commented 3 weeks ago

That was quick! The fix works, thanks :) :+1: