Sign-in: take the address in lower case, as the server keeps it #86

Closed

ryoitsu69 wants to merge 1 commit from ryoitsu69/anotherim-js:fix/sign-in-lower-case into develop

ryoitsu69 commented

2026-11-06 00:30:59 +00:00

Contributor

An address typed with capitals cannot sign in from the desktop or Android app on an ejabberd server: Juliet@capulet.lit is refused as a wrong password, while juliet@capulet.lit signs in with the same password. A sign-up with capitals is refused the same way at the sign-in that follows it. The browser build is not refused.

Cause. process_sasl2_success in processone/xmpp (xmpp_stream_in.erl, since 8ea4b44) compares the prepared localpart of the stream's from with the SASL name as sent, and libtacky sends the name as the account's row has it. The browser goes over WebSocket, where ejabberd offers no SASL2, and never reaches that check.

Fix. The address is taken in lower case before the account's row exists, so the row, -acc and what the server binds are one spelling from the start:

addressTarget already lower-cased the domain and now does the name too. The password form and OAuth both read it, and Settings > Accounts > Add an account opens the same form.
registeredJid does the same for the sign-in after a sign-up.

Preparing only the SASL name in libtacky would not do: the row keeps its capitals while events turn to the name the server binds, that name is no account, and the FAST token is lost (checked on libtacky v1.2.0-rc2 with that one change). Normalising -acc in libtacky alone would not do either, since the sign-in card watches connState(acc) under the string it sent.

Tests. Three new ones, each failing without the change, in login-screen.test.ts, registration.test.ts and welcome-shell.test.ts. make test-ui check: 5089 passed, 8 skipped; tsc, the catalogues and check-macos pass.

Checked with a 0.8.0-rc4 AppImage built from this branch, on another.im: an address typed with capitals signs in and the account is stored in lower case, for the first account and for a second one added from inside the app.

Not covered:

A row already written with capitals stays as it is: such an account is still refused until it is removed and added again.
Android runs the same UI code but was not run on a phone with this change. A sign-up with capitals is covered by the unit test only.
The SSO broker's account.jid is passed on as it comes.
Other hosts, and the -acc and -chat lookups of another-im/libtacky#19.

🤖 Generated with Claude Code

An address typed with capitals cannot sign in from the desktop or Android app on an ejabberd server: `Juliet@capulet.lit` is refused as a wrong password, while `juliet@capulet.lit` signs in with the same password. A sign-up with capitals is refused the same way at the sign-in that follows it. The browser build is not refused. **Cause.** `process_sasl2_success` in processone/xmpp (`xmpp_stream_in.erl`, since 8ea4b44) compares the prepared localpart of the stream's `from` with the SASL name as sent, and libtacky sends the name as the account's row has it. The browser goes over WebSocket, where ejabberd offers no SASL2, and never reaches that check. **Fix.** The address is taken in lower case before the account's row exists, so the row, `-acc` and what the server binds are one spelling from the start: - `addressTarget` already lower-cased the domain and now does the name too. The password form and OAuth both read it, and Settings > Accounts > Add an account opens the same form. - `registeredJid` does the same for the sign-in after a sign-up. Preparing only the SASL name in libtacky would not do: the row keeps its capitals while events turn to the name the server binds, that name is no account, and the FAST token is lost (checked on libtacky v1.2.0-rc2 with that one change). Normalising `-acc` in libtacky alone would not do either, since the sign-in card watches `connState(acc)` under the string it sent. **Tests.** Three new ones, each failing without the change, in `login-screen.test.ts`, `registration.test.ts` and `welcome-shell.test.ts`. `make test-ui check`: 5089 passed, 8 skipped; `tsc`, the catalogues and `check-macos` pass. **Checked** with a 0.8.0-rc4 AppImage built from this branch, on another.im: an address typed with capitals signs in and the account is stored in lower case, for the first account and for a second one added from inside the app. **Not covered:** - A row already written with capitals stays as it is: such an account is still refused until it is removed and added again. - Android runs the same UI code but was not run on a phone with this change. A sign-up with capitals is covered by the unit test only. - The SSO broker's `account.jid` is passed on as it comes. - Other hosts, and the `-acc` and `-chat` lookups of another-im/libtacky#19. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ryoitsu69 added 1 commit

2026-11-06 00:30:59 +00:00

Sign-in: the address is taken in lower case, as the server keeps it. ejabberd's SASL2 (processone/xmpp, process_sasl2_success, since 8ea4b44) compares the prepared localpart of the stream's from with the SASL name as sent, so an address typed with capitals was refused as a wrong password from the desktop and Android apps, while the browser, over WebSocket where ejabberd offers no SASL2, signed in. addressTarget already lower-cased the domain and now does the name too, and registeredJid does the same for the sign-in after a sign-up, so the account's row, -acc and what the server binds are one spelling from the start. Preparing only the SASL name in libtacky is not enough: the row keeps its capitals while events turn to the bound name and the FAST token finds no row. A row already written with capitals stays as it is, to be removed and added again. c3553338f2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ryoitsu69 changed title from Sign-in: the address is taken in lower case, as the server keeps it. ejabberd's SASL2 (processone/xmpp, process_sasl2_success, since 8ea4b44) compares the prepared localpart of the stream's from with the SASL name as sent, so an address typed with ca… to Sign-in: take the address in lower case, as the server keeps it

2026-11-06 00:34:13 +00:00

ryoitsu69 closed this pull request

2026-11-06 15:44:33 +00:00

ryoitsu69 commented

2026-11-06 15:45:24 +00:00

Author

Contributor

Closing: 0.8.0-rc5 already takes the address in lower case (ecce2f19, 59ccee91)

Closing: 0.8.0-rc5 already takes the address in lower case (ecce2f19, 59ccee91)

ryoitsu69 referenced this pull request

2026-11-06 17:50:43 +00:00

Sign-up: a name with capitals ends signed in, not on "Connecting…" #88