romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-01 07:38:02 +03:00
Code Issues Projects Releases Packages Wiki Activity

imap: Provide method to disable SASL if it is advertised

Browse source 
- Implement AUTH=+LOGIN for CURLOPT_LOGIN_OPTIONS to prefer plaintext
  LOGIN over SASL auth.

Prior to this change there was no method to be able to fall back to
LOGIN if an IMAP server advertises SASL capabilities. However, this may
be desirable for e.g. a misconfigured server.

Per: https://www.ietf.org/rfc/rfc5092.html#section-3.2

";AUTH=<enc-auth-type>" looks to be the correct way to specify what
authenication method to use, regardless of SASL or not.

Closes https://github.com/curl/curl/pull/10041
This commit is contained in:
Chris Talbot 2022-12-05 18:05:01 -05:00 • committed by Jay Satiro
parent 2b6222a64c
commit 64aefea3d9
5 changed files with 92 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/libcurl/opts/CURLOPT_LOGIN_OPTIONS.3
View file

@ -43,6 +43,12 @@ options, such as the preferred authentication mechanism via "AUTH=NTLM" or
"AUTH=*", and should be used in conjunction with the \fICURLOPT_USERNAME(3)\fP
option.
Since 8.2.0, IMAP supports the login option "AUTH=+LOGIN". With this option,
curl uses the plain (not SASL) LOGIN IMAP command even if the server advertises
SASL authentication. Care should be taken in using this option, as it will send
out your password in plain text. This will not work if the IMAP server disables
the plain LOGIN (e.g. to prevent password snooping).
The application does not have to keep the string around after setting this
option.
.SH DEFAULT