{"record":{"id":"b4b4e83c7416696f","repo":"jstedfast/MailKit","slug":"cram-md5-does-not-support-sasl-ir","errorCode":null,"errorMessage":"CRAM-MD5 does not support SASL-IR.","messagePattern":"CRAM-MD5 does not support SASL-IR\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/SaslMechanismCramMd5.cs","lineNumber":112,"sourceCode":"\t\t/// </remarks>\n\t\t/// <returns>The next challenge response.</returns>\n\t\t/// <param name=\"token\">The server's challenge token.</param>\n\t\t/// <param name=\"startIndex\">The index into the token specifying where the server's challenge begins.</param>\n\t\t/// <param name=\"length\">The length of the server's challenge.</param>\n\t\t/// <param name=\"cancellationToken\">The cancellation token.</param>\n\t\t/// <exception cref=\"System.NotSupportedException\">\n\t\t/// The SASL mechanism does not support SASL-IR.\n\t\t/// </exception>\n\t\t/// <exception cref=\"System.OperationCanceledException\">\n\t\t/// The operation was canceled via the cancellation token.\n\t\t/// </exception>\n\t\t/// <exception cref=\"SaslException\">\n\t\t/// An error has occurred while parsing the server's challenge token.\n\t\t/// </exception>\n\t\tprotected override byte[]? Challenge (byte[]? token, int startIndex, int length, CancellationToken cancellationToken)\n\t\t{\n\t\t\tif (token == null)\n\t\t\t\tthrow new NotSupportedException (\"CRAM-MD5 does not support SASL-IR.\");\n\n\t\t\tif (IsAuthenticated)\n\t\t\t\treturn null;\n\n\t\t\tvar userName = Encoding.UTF8.GetBytes (Credentials.UserName);\n\t\t\tvar password = Encoding.UTF8.GetBytes (Credentials.Password);\n\t\t\tvar ipad = new byte[64];\n\t\t\tvar opad = new byte[64];\n\t\t\tbyte[] digest, passwd;\n\n\t\t\tif (password.Length > 64) {\n\t\t\t\tusing (var md5 = MD5.Create ())\n\t\t\t\t\tpasswd = md5.ComputeHash (password);\n\t\t\t} else {\n\t\t\t\tpasswd = password;\n\t\t\t}\n\n\t\t\tArray.Copy (passwd, ipad, passwd.Length);","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/SaslMechanismCramMd5.cs#L94-L130","documentation":"CRAM-MD5 is challenge/response: the client must wait for the server's challenge and cannot send initial data (SASL-IR). Calling Challenge with a null token (which represents initial-response mode) throws NotSupportedException.","triggerScenarios":"Using SaslMechanismCramMd5 with a protocol/server path that attempts SASL Initial Client Response (sending credentials with the AUTH command instead of waiting for '+ '), or directly calling Challenge(null, ...) in tests/custom code.","commonSituations":"Enabling SASL-IR in an IMAP/SMTP client implementation while negotiating CRAM-MD5, custom SASL drivers that optimistically send an initial response for every mechanism.","solutions":["Do not advertise CRAM-MD5 on connections where SASL-IR is used; select a mechanism that supports IR (e.g. PLAIN, SCRAM-SHA-256) or let the server send its challenge first.","Configure the client/library layer to disable initial-response for CRAM-MD5.","If writing custom protocol code, pass the server's actual challenge bytes (never null) to Challenge()."],"exampleFix":"// before\nclient.Authenticate(saslUri, new SaslMechanismCramMd5(user, pass)); // client sends SASL-IR\n// after\nclient.Authenticate(saslUri, new SaslMechanismScramSha256(user, pass)); // supports SASL-IR\n// or disable initial response for the CRAM-MD5 path","handlingStrategy":"try-catch","validationCode":"// don't request SASL-IR for CRAM-MD5\nbool supportsInitialResponse = mech is not SaslMechanismCramMd5;","typeGuard":null,"tryCatchPattern":"try {\n    client.Authenticate(uri, new SaslMechanismCramMd5(user, pass));\n} catch (NotSupportedException) {\n    client.Authenticate(uri, new SaslMechanismScramSha256(user, pass));\n}","preventionTips":["Disable SASL initial-response when negotiating CRAM-MD5","Pick SCRAM or PLAIN if the protocol path requires SASL-IR","Never call Challenge(null, ...) manually for challenge/response mechanisms"],"tags":["sasl","cram-md5","unsupported-feature"],"backgroundTag":"unsupported-operation","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}