topic
Verified 2026-09-18SCRAM Authentication
SCRAM uses a salted challenge-response exchange to authenticate a password without sending the password itself.
Use SCRAM only with a complete implementation of the selected hash and channel-binding mode. Store salted verifier data, enforce nonce freshness, and still protect the exchange with TLS.
httpauthsecurityauthentication
Reference (http)
Authorization: SCRAM-SHA-256 data
Use SCRAM only with a complete implementation of the selected hash and channel-binding mode. Store salted verifier data, enforce nonce freshness, and still protect the exchange with TLS.
Common mistakes
- Storing plaintext passwords, accepting a server nonce supplied by an attacker without validation, or ignoring channel binding when the deployment requires it.