auth: disable PLAIN when other mechanisms are supported

PLAIN mechanism sends password in BASE64 encoding which everyone can read. As result, debug logs expose password and users often don't remove it when post the logs in the Internet. Usually, both a secure mechanism and PLAIN are used in the scenario when username or password is incorrect. PLAIN fails in this scenario anyway.
2019-10-01 23:38:50 +03:00
parent 30f3cc9263
commit 2bf5cc0e41
2 changed files with 5 additions and 0 deletions
--- a/1
+++ b/1
@@ -1,4 +1,5 @@
 0.9.3
+	- PLAIN mechanism is used only when no other mechanisms are supported
 	- Legacy authentication is disabled by default, can be enabled with
 	  connection flag XMPP_CONN_FLAG_LEGACY_AUTH
 	- Session is not established if it is optional