diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2025-07-07 23:48:44 +0400 |
|---|---|---|
| committer | pluknet <pluknet@nginx.com> | 2025-08-13 18:20:34 +0400 |
| commit | 9c02c84a7443f3d736a1a5eb3f596de9af8a0c9c (patch) | |
| tree | 389d42d2be0efeb3a292a71f8280d287a713cc30 /src/mail/ngx_mail_auth_http_module.c | |
| parent | 765642b86e0df1b5ef37f42522be7d08d95909c9 (diff) | |
| download | nginx-9c02c84a7443f3d736a1a5eb3f596de9af8a0c9c.tar.gz nginx-9c02c84a7443f3d736a1a5eb3f596de9af8a0c9c.tar.bz2 | |
Mail: reset stale auth credentials with "smtp_auth none;".
They might be reused in a session if an SMTP client proceeded
unauthenticated after previous invalid authentication attempts.
This could confuse an authentication server when passing stale
credentials along with "Auth-Method: none".
The condition to send the "Auth-Salt" header is similarly refined.
Diffstat (limited to 'src/mail/ngx_mail_auth_http_module.c')
| -rw-r--r-- | src/mail/ngx_mail_auth_http_module.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c index 27f64b92e..4ca6d6e24 100644 --- a/src/mail/ngx_mail_auth_http_module.c +++ b/src/mail/ngx_mail_auth_http_module.c @@ -1321,7 +1321,10 @@ ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool, b->last = ngx_copy(b->last, passwd.data, passwd.len); *b->last++ = CR; *b->last++ = LF; - if (s->auth_method != NGX_MAIL_AUTH_PLAIN && s->salt.len) { + if ((s->auth_method == NGX_MAIL_AUTH_APOP + || s->auth_method == NGX_MAIL_AUTH_CRAM_MD5) + && s->salt.len) + { b->last = ngx_cpymem(b->last, "Auth-Salt: ", sizeof("Auth-Salt: ") - 1); b->last = ngx_copy(b->last, s->salt.data, s->salt.len); |