Github user PommeVerte commented on the pull request:
https://github.com/apache/incubator-tinkerpop/pull/291#issuecomment-211383008
Hey @mike-tr-adamson .
I had a look at [`RFC 4422 section
3.2`](https://tools.ietf.org/html/rfc4422#section-3.2) and it seems to imply
that `mechanism` negotiation implementations are essentially our choice. I was
wondering why you decided to prepend it to the payload, rather than say, add it
to the payload, or negotiate it after authentication as pointed out in the RFC
(to avoid downgrade attacks for users who want to extend the server
capabilities here)
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
