Skip to content

fix: enforce authentication method continuity - #142

Open
OllieinCanada wants to merge 1 commit into
microsoft:mainfrom
OllieinCanada:fix/auth-method-continuity-136
Open

fix: enforce authentication method continuity#142
OllieinCanada wants to merge 1 commit into
microsoft:mainfrom
OllieinCanada:fix/auth-method-continuity-136

Conversation

@OllieinCanada

Copy link
Copy Markdown

Fixes #136

Problem

Enhanced authentication accepted incoming AUTH packets and successful CONNACK packets without proving that their Authentication Method matched the method selected by the client. Reauthentication also reused the peer-provided method instead of retaining the method that initiated the exchange.

Fix

Require every incoming enhanced-auth packet to carry the exact expected Authentication Method. Reauthentication now stores the initiating method alongside its completion notifier and uses that retained value throughout the exchange. Missing or mismatched methods fail as protocol errors rather than completing authentication.

Tests

Deterministic in-memory transport tests cover:

  • mismatched method in the initial AUTH
  • missing method in a successful CONNACK
  • mismatched method during reauthentication
  • the existing successful initial-auth and reauth flow

Validation completed with isolated build artifacts:

  • focused auth suite: 4 passed
  • full unit suite: 262 passed
  • standard and websocket integration matrices: passed
  • both repository clippy feature matrices with warnings denied: passed
  • cargo fmt --all -- --check: passed
  • git diff --check: passed

Signed-off-by: Oliver Slapinski <olliefromcanada@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Enhanced authentication does not enforce Authentication Method continuity

1 participant