인증 검증은 호출자 사전 검사에 의존하지 않기

ClickHouse의 SCRAM 증명은 비밀번호만 검증할 수 있어 설정된 TOTP를 확인하지 못한다. 현재 진입 경로가 이 조합을 거부하더라도 인증 검사 자체에서 지원할 수 없는 자격 증명 조합을 거부해야 향후 다른 호출 경로에서도 안전하다.

Summary#

Problem#

SCRAM 인증 함수가 TOTP 설정을 무시하고 비밀번호 증명만으로 인증할 수 있음

Solution#

인증 함수에서 TOTP가 필요한 계정의 SCRAM 검증을 fail-closed로 처리한다.

Failure Modes#

프런트엔드의 사전 필터링만 신뢰함
새 호출 경로가 추가되면서 2차 인증이 우회됨

Sources#

https://github.com/tensorflow/tensorflow/pull/128701
https://github.com/tensorflow/tensorflow/pull/128996
https://github.com/huggingface/transformers/pull/49610
https://github.com/huggingface/transformers/pull/48992
https://github.com/huggingface/transformers/pull/49664
https://github.com/huggingface/transformers/pull/49657
https://github.com/huggingface/transformers/pull/49652
https://github.com/huggingface/transformers/pull/49428
https://github.com/huggingface/transformers/pull/49557
https://github.com/huggingface/transformers/pull/49660
https://github.com/huggingface/transformers/pull/49548
https://github.com/huggingface/transformers/pull/49661
https://github.com/huggingface/transformers/pull/49654
https://github.com/huggingface/transformers/pull/49653
https://github.com/ClickHouse/ClickHouse/pull/126279
https://github.com/ClickHouse/ClickHouse/pull/123341
https://github.com/ClickHouse/ClickHouse/pull/126269
https://github.com/ClickHouse/ClickHouse/pull/117408
https://github.com/ClickHouse/ClickHouse/pull/126160
https://github.com/ClickHouse/ClickHouse/pull/126180
https://github.com/ClickHouse/ClickHouse/pull/122896
https://github.com/ClickHouse/ClickHouse/pull/121704
https://github.com/ClickHouse/ClickHouse/pull/113040
https://github.com/ClickHouse/ClickHouse/pull/126281
https://github.com/ClickHouse/ClickHouse/pull/126280
https://github.com/ClickHouse/ClickHouse/pull/125892
https://github.com/ClickHouse/ClickHouse/pull/119510
https://github.com/ClickHouse/ClickHouse/pull/126136
https://github.com/rustfs/rustfs/pull/8616
https://github.com/rustfs/rustfs/pull/8612
https://github.com/rustfs/rustfs/pull/8607
https://github.com/rustfs/rustfs/pull/8606
https://github.com/rustfs/rustfs/pull/8602
https://github.com/rustfs/rustfs/pull/8576
https://github.com/rustfs/rustfs/pull/8604
https://github.com/rustfs/rustfs/pull/8600
https://github.com/rustfs/rustfs/pull/8539
https://github.com/rustfs/rustfs/pull/8601
https://github.com/rustfs/rustfs/pull/8594
https://github.com/rustfs/rustfs/pull/8557
mined_at: 2026-10-16T15:39:41Z

Sagwan Revalidation 2026-10-16T16:13:20Z#

verdict: refresh
note: 핵심 권장안은 타당하지만 무관한 출처가 다수 섞여 있어 근거를 정리할 가치가 있다.

Sagwan Revalidation 2026-10-19T12:20:17Z#

verdict: refresh
note: 권장안은 타당하지만 무관한 출처가 다수 섞여 있어 근거 정리가 필요하다.