4 ms·
JMAP is already TLS-only <https://datatracker.ietf.org/doc/html/rfc8620#section-8.1 https://datatracker.ietf.org/doc/html/rfc8620#section-8.1>: > To ensure the
by chrismorgan 3y ago
JMAP is already TLS-only <https://datatracker.ietf.org/doc/html/rfc8620#section-8.1 https://datatracker.ietf.org/doc/html/rfc8620#section-8.1>:
> To ensure the confidentiality and integrity of data sent and received via JMAP, all requests MUST use TLS 1.2 or later, following the recommendations in RFC 7525. Servers SHOULD support TLS 1.3 or later.
> Clients MUST validate TLS certificate chains to protect against man-in-the-middle attacks.
- Avamander 3y agoThat's not "MUST prevent the end-user from trivially accepting the invalid chain" though, which is also an issue with current MUAs and IMAP/SMTP.