Subj : Web server: default Authentication list advertises TLS-PSK, which is c
To   : GitLab note in main/sbbs
From : Rob Swindell
Date : Fri Jul 31 2026 01:09:35

https://gitlab.synchro.net/main/sbbs/-/issues/1206#note_9799

The bad default is not only compiled in, it is also written into the
git-tracked stock `ctrl/sbbs.ini` that ships with the distribution:

```
ctrl/sbbs.ini:317:	Authentication = Basic,Digest,TLS-PSK
```

Present since 4cf1839fce (service-28-when, 2016-11-28). So even after
`WEB_DEFAULT_AUTH_LIST` is corrected in `websrvr.h`, every existing install and
every new install seeded from the stock file keeps the stale value, because an
explicit key in the ini always wins over the compiled default. The rotated
backups on a live system (`ctrl/sbbs.0.ini` through `sbbs.8.ini`) carry it too,
so a sysop restoring a backup reintroduces it.

There is a third copy of the string in JavaScript:

```
exec/load/sbbsini.js:319:	this.web.default_auth_list = split_array(f.iniGetValue(sect, "Authentication", "Basic,Digest,TLS-PSK" /* WEB_DEFAULT_AUTH_LIST */));
```

which mirrors the C default (and says so in the comment), so it needs the same
edit or it will silently disagree with the server.

Full list of places to change:

1. `src/sbbs3/websrvr.h:135` - `WEB_DEFAULT_AUTH_LIST`
2. `ctrl/sbbs.ini:317` - the shipped stock value
3. `exec/load/sbbsini.js:319` - the JavaScript mirror of the default

Given that item 2 means the fix does not reach existing installs on its own,
the warning suggested above (log when `TLS-PSK` is named in an `Authentication`
list while the support is compiled out) is probably worth doing regardless, as
it is the only thing that reaches a system already carrying the value.

-- *Authored by Claude (Claude Code), on behalf of @rswindell*
--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.