Tighten SCRAM-SHA-256 SASL check (#6023)

vonzshik · web-flow · commit 01155b635f36 · 2025-02-24T11:05:39.000Z
diff --git a/src/Npgsql/Internal/NpgsqlConnector.Auth.cs b/src/Npgsql/Internal/NpgsqlConnector.Auth.cs
@@ -71,10 +71,10 @@ async Task AuthenticateSASL(List<string> mechanisms, string username, bool async
     {
         // At the time of writing PostgreSQL only supports SCRAM-SHA-256 and SCRAM-SHA-256-PLUS
         var serverSupportsSha256 = mechanisms.Contains("SCRAM-SHA-256");
-        var clientSupportsSha256 = serverSupportsSha256 && Settings.ChannelBinding != ChannelBinding.Require;
+        var allowSha256 = serverSupportsSha256 && Settings.ChannelBinding != ChannelBinding.Require;
         var serverSupportsSha256Plus = mechanisms.Contains("SCRAM-SHA-256-PLUS");
-        var clientSupportsSha256Plus = serverSupportsSha256Plus && Settings.ChannelBinding != ChannelBinding.Disable;
-        if (!clientSupportsSha256 && !clientSupportsSha256Plus)
+        var allowSha256Plus = serverSupportsSha256Plus && Settings.ChannelBinding != ChannelBinding.Disable;
+        if (!allowSha256 && !allowSha256Plus)
         {
             if (serverSupportsSha256 && Settings.ChannelBinding == ChannelBinding.Require)
                 throw new NpgsqlException($"Couldn't connect because {nameof(ChannelBinding)} is set to {nameof(ChannelBinding.Require)} " +
@@ -92,10 +92,10 @@ async Task AuthenticateSASL(List<string> mechanisms, string username, bool async
         var cbind = string.Empty;
         var successfulBind = false;
 
-        if (clientSupportsSha256Plus)
+        if (allowSha256Plus)
             DataSource.TransportSecurityHandler.AuthenticateSASLSha256Plus(this, ref mechanism, ref cbindFlag, ref cbind, ref successfulBind);
 
-        if (!successfulBind && serverSupportsSha256)
+        if (!successfulBind && allowSha256)
         {
             mechanism = "SCRAM-SHA-256";
             // We can get here if PostgreSQL supports only SCRAM-SHA-256 or there was an error while binding to SCRAM-SHA-256-PLUS
diff --git a/src/Npgsql/Internal/NpgsqlConnector.cs b/src/Npgsql/Internal/NpgsqlConnector.cs
@@ -1658,12 +1658,12 @@ internal void ClearTransaction(Exception? disposeReason = null)
     internal bool IsSecure { get; private set; }
 
     /// <summary>
-    /// Returns whether SCRAM-SHA256 is being user for the connection
+    /// Returns whether SCRAM-SHA256 is being used for the connection
     /// </summary>
     internal bool IsScram { get; private set; }
 
     /// <summary>
-    /// Returns whether SCRAM-SHA256-PLUS is being user for the connection
+    /// Returns whether SCRAM-SHA256-PLUS is being used for the connection
     /// </summary>
     internal bool IsScramPlus { get; private set; }
 
