From e08ee1925cd39b1cfb466a03b2fae1021e8ce751 Mon Sep 17 00:00:00 2001 From: jonahbeckford <71855677+jonahbeckford@users.noreply.github.com> Date: Fri, 24 Jun 2022 16:31:11 -0700 Subject: [PATCH] Document responsibility for server-side id. #276 (#277) * Document responsibility for server-side id. #276 This is a passive warning to the server implementor to not blindly trust the client to send the same identifier in both [RegistrationRequest] and [RegistrationUpload]. * Perform suggested copy-editing * Update src/lib.rs Add wording "typically supplied by the client" Co-authored-by: daxpedda Co-authored-by: Jonah Beckford <9566106-jonahbeckford@users.noreply.gitlab.com> Co-authored-by: daxpedda --- src/lib.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/lib.rs b/src/lib.rs index 8ea734c..32a68c0 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -89,6 +89,9 @@ //! key-value database, where the keys consist of these server-side identifiers //! for each client, and the values consist of their corresponding password //! files, to be retrieved upon future login attempts made by the client. +//! It is your responsibility to ensure that the identifier used to form the +//! initial [RegistrationRequest], typically supplied by the client, matches +//! the database key used in the final [RegistrationUpload] step. //! //! Note that the [RegistrationUpload] message contains sensitive information //! (about as sensitive as a hash of the password), and hence should be