{"record":{"id":"bc1f47e8dc99af8d","repo":"pocketbase/pocketbase","slug":"unencrypted-connection","errorCode":null,"errorMessage":"unencrypted connection","messagePattern":"unencrypted connection","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tools/mailer/smtp.go","lineNumber":192,"sourceCode":"// Otherwise authentication will fail with an error, without sending the credentials.\n//\n// [1]: https://github.com/golang/go/issues/40817\n// [2]: https://support.microsoft.com/en-us/office/outlook-com-no-longer-supports-auth-plain-authentication-07f7d5e9-1697-465f-84d2-4513d4ff0145?ui=en-us&rs=en-us&ad=us\ntype smtpLoginAuth struct {\n\tusername, password string\n}\n\n// Start initializes an authentication with the server.\n//\n// It is part of the [smtp.Auth] interface.\nfunc (a *smtpLoginAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {\n\t// Must have TLS, or else localhost server.\n\t// Note: If TLS is not true, then we can't trust ANYTHING in ServerInfo.\n\t// In particular, it doesn't matter if the server advertises LOGIN auth.\n\t// That might just be the attacker saying\n\t// \"it's ok, you can trust me with your password.\"\n\tif !server.TLS && !isLocalhost(server.Name) {\n\t\treturn \"\", nil, errors.New(\"unencrypted connection\")\n\t}\n\n\treturn \"LOGIN\", nil, nil\n}\n\n// Next \"continues\" the auth process by feeding the server with the requested data.\n//\n// It is part of the [smtp.Auth] interface.\nfunc (a *smtpLoginAuth) Next(fromServer []byte, more bool) ([]byte, error) {\n\tif more {\n\t\tswitch strings.ToLower(string(fromServer)) {\n\t\tcase \"username:\":\n\t\t\treturn []byte(a.username), nil\n\t\tcase \"password:\":\n\t\t\treturn []byte(a.password), nil\n\t\t}\n\t}\n","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/pocketbase/pocketbase/blob/5d217ddb50cb144d80a5d0b0bdf11b52b2c3e457/tools/mailer/smtp.go#L174-L210","documentation":"Error \"unencrypted connection\" thrown in pocketbase/pocketbase.","triggerScenarios":"Thrown when LOGIN SMTP auth is attempted over a connection that is neither TLS-encrypted nor to a localhost server, because credentials would be sent in plaintext.","commonSituations":"The SMTP server does not support STARTTLS/TLS, or TLS was not negotiated before auth. Enable TLS on the SMTP server or use an auth mechanism safe for the connection.","solutions":["Enable TLS/STARTTLS on the SMTP connection (use port 465 with TLS or 587 with STARTTLS).","Only allow plaintext auth on trusted local networks and explicitly opt in to insecure connections.","Verify the SMTP server supports STARTTLS with `openssl s_client -starttls smtp -connect host:587`."],"exampleFix":"m := mailer.NewSMTP(\"smtp.example.com\", 587, user, pass)\nm.TLSConfig = &tls.Config{ServerName: \"smtp.example.com\", MinVersion: tls.VersionTLS12}","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5d217ddb50cb144d80a5d0b0bdf11b52b2c3e457","analyzedAt":"2026-08-15T10:06:33.165Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}