{"record":{"id":"393437f0a65818ec","repo":"jstedfast/MailKit","slug":"negotiate","errorCode":null,"errorMessage":"negotiate","messagePattern":"negotiate","errorType":"validation","errorClass":"ArgumentNullException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/Ntlm/NtlmAuthenticateMessage.cs","lineNumber":45,"sourceCode":"// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/b38c36ed-2804-4868-a9ff-8dd3182128e4\n\nusing System;\nusing System.Text;\nusing System.Diagnostics.CodeAnalysis;\n\nnamespace MailKit.Security.Ntlm {\n\tclass NtlmAuthenticateMessage : NtlmMessageBase\n\t{\n\t\tstatic readonly byte[] Z16 = new byte[16];\n\n\t\treadonly NtlmNegotiateMessage? negotiate;\n\t\treadonly NtlmChallengeMessage? challenge;\n\t\tbyte[] clientChallenge;\n\n\t\tpublic NtlmAuthenticateMessage (NtlmNegotiateMessage negotiate, NtlmChallengeMessage challenge, string userName, string password, string domain, string workstation) : base (3)\n\t\t{\n\t\t\tif (negotiate == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (negotiate));\n\n\t\t\tif (challenge == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (challenge));\n\n\t\t\tif (userName == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (userName));\n\n\t\t\tif (password == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (password));\n\n\t\t\tclientChallenge = NtlmUtils.NONCE (8);\n\t\t\tthis.negotiate = negotiate;\n\t\t\tthis.challenge = challenge;\n\n\t\t\tif (!string.IsNullOrEmpty (domain)) {\n\t\t\t\tDomain = domain;\n\t\t\t} else if ((challenge.Flags & NtlmFlags.TargetTypeDomain) != 0) {\n\t\t\t\t// The server is domain-joined, so the TargetName will be the domain.","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/Ntlm/NtlmAuthenticateMessage.cs#L27-L63","documentation":"The NtlmAuthenticateMessage constructor throws ArgumentNullException when the negotiate parameter is null. The NTLM AUTHENTICATE message requires the preceding NEGOTIATE message to build the Type3 payload, so it is a mandatory argument.","triggerScenarios":"Calling new NtlmAuthenticateMessage(null, challenge, ...) — e.g. the negotiate message was never created or a method returned null on a parse failure.","commonSituations":"Siloed NTLM handshake code where the Type1 message creation is skipped or its parse failed silently; refactors that reorder the handshake steps.","solutions":["Create the NtlmNegotiateMessage before constructing the authenticate message.","Check the negotiate value for null before calling the constructor.","If negotiate comes from a parse/decode call, handle its failure path instead of passing null through."],"exampleFix":"// before\nvar auth = new NtlmAuthenticateMessage(negotiate, challenge, user, pass, domain, ws); // negotiate is null\n// after\nif (negotiate == null) negotiate = new NtlmNegotiateMessage();\nvar auth = new NtlmAuthenticateMessage(negotiate, challenge, user, pass, domain, ws);","handlingStrategy":"validation","validationCode":"if (negotiate == null) throw new InvalidOperationException(\"NTLM negotiate message must be created before the authenticate message.\");\nvar auth = new NtlmAuthenticateMessage(negotiate, challenge, userName, password, domain, workstation);","typeGuard":"static bool CanBuildAuthMessage(NtlmNegotiateMessage n, NtlmChallengeMessage c) => n != null && c != null;","tryCatchPattern":"try {\n\tauth = new NtlmAuthenticateMessage(negotiate, challenge, userName, password, domain, workstation);\n} catch (ArgumentNullException ex) when (ex.ParamName == \"negotiate\") {\n\t// recreate the Type1 message and retry the handshake\n\tnegotiate = new NtlmNegotiateMessage();\n\tauth = new NtlmAuthenticateMessage(negotiate, challenge, userName, password, domain, workstation);\n}","preventionTips":["Keep the handshake order explicit: create NEGOTIATE, receive CHALLENGE, then build AUTHENTICATE.","Check nullable results from any parse/decode call before forwarding them.","Enable nullable reference types so null flows are flagged at compile time."],"tags":["null-argument","csharp","ntlm","authentication"],"backgroundTag":"null-argument","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}