{"record":{"id":"49335b4bb3cf4311","repo":"jstedfast/MailKit","slug":"the-login-command-is-disabled","errorCode":null,"errorMessage":"The LOGIN command is disabled.","messagePattern":"The LOGIN command is disabled\\.","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"critical","filePath":"MailKit/Net/Imap/ImapClient.cs","lineNumber":1213,"sourceCode":"\t\t{\n\t\t\tif (encoding == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (encoding));\n\n\t\t\tif (credentials == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (credentials));\n\n\t\t\tCheckDisposed ();\n\t\t\tCheckConnected ();\n\n\t\t\tif (engine.State >= ImapEngineState.Authenticated)\n\t\t\t\tthrow new InvalidOperationException (\"The ImapClient is already authenticated.\");\n\t\t}\n\n\t\tvoid CheckCanLogin (ImapCommand? ic)\n\t\t{\n\t\t\tif ((Capabilities & ImapCapabilities.LoginDisabled) != 0) {\n\t\t\t\tif (ic == null)\n\t\t\t\t\tthrow new AuthenticationException (\"The LOGIN command is disabled.\");\n\n\t\t\t\tthrow CreateAuthenticationException (ic);\n\t\t\t}\n\t\t}\n\n\t\t/// <summary>\n\t\t/// Authenticate using the supplied credentials.\n\t\t/// </summary>\n\t\t/// <remarks>\n\t\t/// <para>Authenticates using the supplied credentials.</para>\n\t\t/// <para>If the IMAP server supports one or more SASL authentication mechanisms,\n\t\t/// then the SASL mechanisms that both the client and server support (not including\n\t\t/// any OAUTH mechanisms) are tried in order of greatest security to weakest security.\n\t\t/// Once a SASL authentication mechanism is found that both client and server support,\n\t\t/// the credentials are used to authenticate.</para>\n\t\t/// <para>If the server does not support SASL or if no common SASL mechanisms\n\t\t/// can be found, then LOGIN command is used as a fallback.</para>\n\t\t/// <note type=\"tip\">To prevent the usage of certain authentication mechanisms,","sourceCodeStart":1195,"sourceCodeEnd":1231,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Imap/ImapClient.cs#L1195-L1231","documentation":"MailKit throws this AuthenticationException when the server advertises LOGINDISABLED, meaning the classic LOGIN command is disabled — typically because the server only permits authentication over a secure (TLS) connection or has disabled plaintext login entirely. CheckCanLogin raises it before the LOGIN command is sent when no suitable SASL mechanism was used.","triggerScenarios":"Authenticating via the plaintext LOGIN fallback while (Capabilities & ImapCapabilities.LoginDisabled) != 0 — e.g. connecting on port 143 without TLS, or passing a credential set that forces LOGIN instead of a SASL mechanism.","commonSituations":"Connecting with SecureSocketOptions.None to a server requiring TLS; Gmail/Office365 disabling basic auth/LOGIN; credentials retrieved via ICredentials that have no SASL-compatible mechanism so MailKit falls back to LOGIN.","solutions":["Connect with TLS: use SecureSocketOptions.SslOnConnect or StartTls (and port 993), which usually re-enables LOGIN","Use a SASL mechanism (e.g. Authenticate with a SaslMechanism like XOAUTH2 or CRAM-MD5) instead of relying on the LOGIN fallback","Check (client.Capabilities & ImapCapabilities.LoginDisabled) after Connect and switch strategy before authenticating","Enable SMTP/IMAP basic-auth or app passwords on the account if the provider recently disabled LOGIN"],"exampleFix":"// before\nclient.Connect (host, 143, SecureSocketOptions.None);\nclient.Authenticate (user, pass); // LOGIN disabled -> AuthenticationException\n// after\nclient.Connect (host, 993, SecureSocketOptions.SslOnConnect);\nclient.Authenticate (user, pass);","handlingStrategy":"fallback","validationCode":"if ((client.Capabilities & ImapCapabilities.LoginDisabled) != 0) throw new InvalidOperationException (\"Server requires TLS/SASL; plaintext LOGIN disabled\");","typeGuard":"bool CanLogin (ImapClient c) => (c.Capabilities & ImapCapabilities.LoginDisabled) == 0;","tryCatchPattern":"try { client.Authenticate (user, pass); } catch (AuthenticationException ex) when (ex.Message.Contains (\"LOGIN command is disabled\")) { // reconnect with TLS or use SASL mechanism\n}","preventionTips":["Always connect on 993 with implicit TLS or use StartTls on 143","Prefer SASL mechanisms (XOAUTH2, CRAM-MD5) over basic LOGIN","Check LoginDisabled capability right after Connect","Keep app passwords/OAuth in place as providers deprecate basic auth"],"tags":["imap","login-disabled","tls","authentication","mailkit"],"backgroundTag":"authentication-required","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}