{"record":{"id":"05fcad31f3370653","repo":"jstedfast/MailKit","slug":"login-does-not-support-sasl-ir","errorCode":null,"errorMessage":"LOGIN does not support SASL-IR.","messagePattern":"LOGIN does not support SASL-IR\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/SaslMechanismLogin.cs","lineNumber":182,"sourceCode":"\t\t/// The SASL mechanism does not support SASL-IR.\n\t\t/// </exception>\n\t\t/// <exception cref=\"System.OperationCanceledException\">\n\t\t/// The operation was canceled via the cancellation token.\n\t\t/// </exception>\n\t\t/// <exception cref=\"SaslException\">\n\t\t/// An error has occurred while parsing the server's challenge token.\n\t\t/// </exception>\n\t\tprotected override byte[]? Challenge (byte[]? token, int startIndex, int length, CancellationToken cancellationToken)\n\t\t{\n\t\t\tif (IsAuthenticated)\n\t\t\t\treturn null;\n\n\t\t\tbyte[]? challenge = null;\n\n\t\t\tswitch (state) {\n\t\t\tcase LoginState.UserName:\n\t\t\t\tif (token == null)\n\t\t\t\t\tthrow new NotSupportedException (\"LOGIN does not support SASL-IR.\");\n\n\t\t\t\tchallenge = encoding.GetBytes (Credentials.UserName);\n\t\t\t\tstate = LoginState.Password;\n\t\t\t\tbreak;\n\t\t\tcase LoginState.Password:\n\t\t\t\tchallenge = encoding.GetBytes (Credentials.Password);\n\t\t\t\tIsAuthenticated = true;\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\treturn challenge;\n\t\t}\n\n\t\t/// <summary>\n\t\t/// Resets the state of the SASL mechanism.\n\t\t/// </summary>\n\t\t/// <remarks>\n\t\t/// Resets the state of the SASL mechanism.","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/SaslMechanismLogin.cs#L164-L200","documentation":"The LOGIN SASL mechanism is a two-step username/password exchange and cannot carry the initial response (SASL-IR). If Challenge() is called with a non-null token while the mechanism still expects the username step, NotSupportedException is thrown. SASL-IR is only valid for mechanisms that define an initial client response.","triggerScenarios":"Passing an initial-response token to SaslMechanismLogin.Challenge(), or using a protocol layer that attempts SASL-IR (e.g. IMAP 'AUTHENTICATE LOGIN <ir>') with the LOGIN mechanism.","commonSituations":"Custom protocol implementations or test harnesses (AssertLogin, TestArgumentExceptions) that send an initial response token to all mechanisms uniformly; misconfigured clients forcing SASL-IR.","solutions":["Do not pass an initial-response token; call Challenge (null, 0, 0) for the first step of the LOGIN exchange","Use PLAIN instead of LOGIN if you need SASL-IR support","Ensure the protocol driver you use does not emit SASL-IR for LOGIN (MailKit's built-in protocols handle this correctly)"],"exampleFix":"// before\nmechanism.Challenge (Encoding.UTF8.GetBytes (\"initial-response\"), 0, len); // throws\n// after\nvar tok = mechanism.Challenge (null, 0, 0); // first step: returns username\nvar tok2 = mechanism.Challenge (serverToken, 0, serverToken.Length); // returns password","handlingStrategy":"validation","validationCode":"// Only pass an initial response to mechanisms that support SASL-IR:\nif (mechanism is SaslMechanismLogin)\n    token = null; // LOGIN never supports SASL-IR\nvar first = mechanism.Challenge (token, 0, token?.Length ?? 0);","typeGuard":"bool SupportsSaslIr (SaslMechanism m) => m is not SaslMechanismLogin;","tryCatchPattern":"try {\n    mechanism.Challenge (ir, 0, ir.Length);\n} catch (NotSupportedException) {\n    // restart exchange with Challenge(null, 0, 0)\n}","preventionTips":["Never send an initial-response token for LOGIN; start with Challenge(null, 0, 0)","Prefer PLAIN over LOGIN when SASL-IR is needed","Rely on MailKit's built-in IMAP/SMTP/POP3 Authenticate methods, which handle SASL-IR correctly"],"tags":["sasl","login","sasl-ir","mailkit"],"backgroundTag":"unsupported-operation","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}