SCRAM

RFC 5802 - Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms https://tools.ietf.org/html/rfc5802

Salted Challenge Response Authentication Mechanism (SCRAM)

SASL and GSS-API Mechanisms

Abstract

   The secure authentication mechanism most widely deployed and used by
   Internet application protocols is the transmission of clear-text
   passwords over a channel protected by Transport Layer Security (TLS).
   There are some significant security concerns with that mechanism,
   which could be addressed by the use of a challenge response
   authentication mechanism protected by TLS.  Unfortunately, the
   challenge response mechanisms presently on the standards track all
   fail to meet requirements necessary for widespread deployment, and
   have had success only in limited use.

   This specification describes a family of Simple Authentication and
   Security Layer (SASL; RFC 4422) authentication mechanisms called the
   Salted Challenge Response Authentication Mechanism (SCRAM), which
   addresses the security concerns and meets the deployability
   requirements.  When used in combination with TLS or an equivalent
   security layer, a mechanism from this family could improve the status
   quo for application protocol authentication and provide a suitable
   choice for a mandatory-to-implement mechanism for future application
   protocol standards.

Authentication Mechanisms — MongoDB Manual https://docs.mongodb.com/manual/core/authentication-mechanisms/