quantranhong1999 commented on code in PR #3089:
URL: https://github.com/apache/james-project/pull/3089#discussion_r3587207313
##########
server/protocols/protocols-pop3/src/main/java/org/apache/james/pop3server/core/PassCmdHandler.java:
##########
@@ -59,7 +62,7 @@
*/
public class PassCmdHandler extends AbstractPassCmdHandler {
private static final Logger LOGGER =
LoggerFactory.getLogger(PassCmdHandler.class);
- private static final PlainSaslMechanism PLAIN_SASL_MECHANISM = new
PlainSaslMechanism(true, false);
+ private static final PlainSaslMechanism PLAIN_SASL_MECHANISM = new
PlainSaslMechanism(ENABLED, !REQUIRE_SSL);
Review Comment:
> Make it true (secure) by default
Currently, POP3 PASS command always accepts clear-text authentication. POP3
does not have the `auth.requireSSL` option yet. `!REQUIRE_SSL` therefore keeps
the existing behavior.
I plan to add `auth.requireSSL` (and other related authentication configs
like `auth.saslMechanisms`) in the upcoming [Implement RFC 5034 SASL for
POP3](https://github.com/linagora/james-project/issues/5574) work.
And then we can make the POP3 PASS command respect the `auth.requireSSL`
option (default to `true`).
Is that OK to you?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
