{"record":{"id":"553b8bbeee6fab62","repo":"jstedfast/MailKit","slug":"invalidchallenge","errorCode":"InvalidChallenge","errorMessage":"Server response contained invalid data.","messagePattern":"Server response contained invalid data\\.","errorType":"error_code","errorClass":"SaslException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/SaslMechanismDigestMd5.cs","lineNumber":169,"sourceCode":"\t\t\t\tencoding = challenge.Charset != null ? Encoding.UTF8 : TextEncodings.Latin1;\n\t\t\t\tcnonce ??= GenerateEntropy (15);\n\n\t\t\t\tresponse = new DigestResponse (challenge, encoding, Uri.Scheme, Uri.DnsSafeHost, AuthorizationId, Credentials.UserName, Credentials.Password, cnonce);\n\t\t\t\tstate = LoginState.Final;\n\n\t\t\t\treturn response.Encode (encoding);\n\t\t\tcase LoginState.Final:\n\t\t\t\tif (token == null || token.Length == 0)\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.MissingChallenge, \"Server response did not contain any authentication data.\");\n\n\t\t\t\tvar text = encoding!.GetString (token, startIndex, length);\n\t\t\t\tstring? key, value;\n\n\t\t\t\tif (!DigestChallenge.TryParseKeyValuePair (text, out key, out value))\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.IncompleteChallenge, \"Server response contained incomplete authentication data.\");\n\n\t\t\t\tif (!key.Equals (\"rspauth\", StringComparison.OrdinalIgnoreCase))\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.InvalidChallenge, \"Server response contained invalid data.\");\n\n\t\t\t\tvar expected = response!.ComputeHash (encoding, Credentials.Password, false);\n\t\t\t\tif (value != expected)\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.IncorrectHash, \"Server response did not contain the expected hash.\");\n\n\t\t\t\tIsAuthenticated = true;\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\treturn null;\n\t\t}\n\n\t\t/// <summary>\n\t\t/// Reset the state of the SASL mechanism.\n\t\t/// </summary>\n\t\t/// <remarks>\n\t\t/// Resets the state of the SASL mechanism.\n\t\t/// </remarks>","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/SaslMechanismDigestMd5.cs#L151-L187","documentation":"During the final step of a DIGEST-MD5 SASL exchange, the server's response is scanned for the 'rspauth' key-value pair. MailKit throws this SaslException (SaslErrorCode.InvalidChallenge) when the response contains a valid key=value pair whose key is anything other than 'rspauth', meaning the server sent unexpected authentication data instead of the required response-auth verification.","triggerScenarios":"Calling Challenge on SaslMechanismDigestMd5 with the final server token when the parsed key is not 'rspauth' (e.g. the server sends another directive like 'realm' or 'nonce' at the final-response stage, or a malformed/garbage token that still parses as key=value).","commonSituations":"Talking to a non-conformant or buggy SMTP/IMAP/POP3 server whose final DIGEST-MD5 step omits rspauth or sends extra directives; a proxy/MITM altering the final challenge; server software upgrades changing challenge format.","solutions":["Inspect the raw server token sent in the final DIGEST-MD5 step (log Challenge input) and confirm the server actually emits rspauth.","Verify you are using the correct SASL mechanism for this server; fall back to a simpler mechanism like CRAM-MD5 or PLAIN over TLS.","Update the server software (or MailKit) to a version whose DIGEST-MD5 implementation conforms to RFC 2831.","If the server is behind a proxy/firewall, bypass or reconfigure it to see if it mangles the SASL exchange.","Disable DIGEST-MD5 on the server and use another auth mechanism."],"exampleFix":"// before: mechanism selected as DIGEST-MD5 against a server that omits rspauth\nvar client = new SmtpClient ();\nawait client.Connect (\"smtp.example.com\", 587);\nawait client.Authenticate (\"user\", \"pass\");\n\n// after: prefer a well-supported mechanism / catch and fall back\nvar client = new SmtpClient ();\nawait client.Connect (\"smtp.example.com\", 587, SecureSocketOptions.StartTls);\ntry {\n\tawait client.Authenticate (\"user\", \"pass\");\n} catch (SaslException ex) when (ex.ErrorCode == SaslErrorCode.InvalidChallenge) {\n\t// fall back or report non-conformant server\n\tthrow;\n}","handlingStrategy":"try-catch","validationCode":"// Verify the server advertises DIGEST-MD5 before choosing it\nif (!client.AuthenticationMechanisms.Contains (\"DIGEST-MD5\"))\n\tthrow new InvalidOperationException (\"Server does not support DIGEST-MD5\");","typeGuard":null,"tryCatchPattern":"try {\n\tawait client.Authenticate (new SaslMechanismDigestMd5 (user, pass));\n} catch (SaslException ex) when (ex.ErrorCode == SaslErrorCode.InvalidChallenge) {\n\t// non-conformant server final response; fall back or report\n\tlogger.LogWarning (ex, \"DIGEST-MD5 failed with InvalidChallenge\");\n\tawait client.Authenticate (new SaslMechanismLogin (user, pass));\n}","preventionTips":["Only select DIGEST-MD5 when the server advertises it in AuthenticationMechanisms.","Prefer PLAIN/LOGIN over TLS instead of DIGEST-MD5 with servers known to be non-conformant.","Log raw SASL challenges in a debug flag so malformed final responses are diagnosable.","Keep MailKit and server software up to date with RFC 2831-conformant versions."],"tags":["sasl","digest-md5","authentication","protocol"],"backgroundTag":"unexpected-response-shape","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}