Imported from previous forum
If I get a logon message with a bad username or password or target compid should I just drop the connection or should I send a reject message?
[ original email was from Harish Kamaley - harish.kamaley@wipro.com ]
Hi Robert,
If you receive Logon message with unauthenticated/non-configured identity then the response would be as follows :
1.Generate an “error” condition in test output.
2.Disconnect without sending a message (note sending a Reject or Logout would consume a MsgSeqNum)
Regards
If I get a logon message with a bad username or password or target compid should I just drop the connection or should I send a reject message?
Excerpt from the FIX Spec (FIX Transport, previously Volume 2):
The initiator sends a Logon message. The acceptor will authenticate the identity of the initiator by examining the Logon message. The Logon message will contain the data necessary to support the previously agreed upon authentication method. If the initiator is successfully authenticated, the acceptor responds with a Logon message. If authentication fails, the session acceptor should shut down the connection after optionally sending a Logout message to indicate the reason of failure. Sending a Logout in this case is not required because doing so would consume a sequence number for that session, which in some cases may be problematic.
If I get a logon message with a bad username or password or target compid should I just drop the connection or should I send a reject message?
Hi Robert,
I think the answer lies in the statement “If authentication fails, the session acceptor should shut down the connection after optionally sending a Logout message to indicate the reason of failure.”.
Bad username or password is an example of authentication failure. So you can shut down the connection. Sending a logout is optional and in fact not recommended.
Regards,
Amit
Excerpt from the FIX Spec (FIX Transport, previously Volume 2):
The initiator sends a Logon message. The acceptor will authenticate the identity of the initiator by examining the Logon message. The Logon message will contain the data necessary to support the previously agreed upon authentication method. If the initiator is successfully authenticated, the acceptor responds with a Logon message. If authentication fails, the session acceptor should shut down the connection after optionally sending a Logout message to indicate the reason of failure. Sending a Logout in this case is not required because doing so would consume a sequence number for that session, which in some cases may be problematic.
If I get a logon message with a bad username or password or target compid should I just drop the connection or should I send a reject message?
[Start quote from FIX_Transport_1.1.pdf page 37 / 66]
When to send a Logout vs. when to just disconnect
In general a Logout message should always be sent prior to shutting down a connection. If the Logout is being sent due to an error condition, the Text field of the Logout should provide a descriptive reason, so that operational support of the remote FIX system can diagnosis the problem. There are exceptions, when it is recommended that a Logout message not be sent, these include:
-
If during a logon either the SenderCompID, TargetCompID or IP address of the session initiator is invalid, it is recommended that the session be immediately terminated and no Logout message sent. This login attempt might be an unauthorized attempt to break into your system; hence one does not want to divulge any information about one’s FIX system, such as: which SenderCompID/TargetCompID values are valid or which version of FIX is supported.
-
If during a Logon one receives a second connection attempt while a valid FIX session is already underway for that same SenderCompID, it is recommended that the session acceptor immediately terminate the second connection attempt and not send a Logout message. Sending a Logout message runs the risk of interfering with and possibly adversely affecting the current active FIX connection. For example, in some FIX system implementations, sending a Logout message might consume a sequence number that would cause an out of sequence condition for the established FIX session.
In all other cases, if sending a Logout does not create risk or violate security, a Logout message should be sent with a descriptive text message.
[End quote]
Hi Robert,
I think the answer lies in the statement “If authentication fails, the session acceptor should shut down the connection after optionally sending a Logout message to indicate the reason of failure.”.
Bad username or password is an example of authentication failure. So you can shut down the connection. Sending a logout is optional and in fact not recommended.Regards,
AmitExcerpt from the FIX Spec (FIX Transport, previously Volume 2):
The initiator sends a Logon message. The acceptor will authenticate the identity of the initiator by examining the Logon message. The Logon message will contain the data necessary to support the previously agreed upon authentication method. If the initiator is successfully authenticated, the acceptor responds with a Logon message. If authentication fails, the session acceptor should shut down the connection after optionally sending a Logout message to indicate the reason of failure. Sending a Logout in this case is not required because doing so would consume a sequence number for that session, which in some cases may be problematic.
If I get a logon message with a bad username or password or target compid should I just drop the connection or should I send a reject message?