{"record":{"id":"c3dc694080706085","repo":"jstedfast/MailKit","slug":"password-too-long","errorCode":null,"errorMessage":"Password too long.","messagePattern":"Password too long\\.","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Proxy/Socks5Client.cs","lineNumber":248,"sourceCode":"\t\t\t} while (n < 2);\n\n\t\t\tVerifySocksVersion (buffer[0]);\n\n\t\t\treturn (Socks5AuthMethod) buffer[1];\n\t\t}\n\n\t\tbyte[] GetAuthenticateCommand ()\n\t\t{\n\t\t\tvar user = Encoding.UTF8.GetBytes (ProxyCredentials!.UserName);\n\n\t\t\tif (user.Length > 255)\n\t\t\t\tthrow new AuthenticationException (\"User name too long.\");\n\n\t\t\tvar passwd = Encoding.UTF8.GetBytes (ProxyCredentials.Password);\n\n\t\t\tif (passwd.Length > 255) {\n\t\t\t\tArray.Clear (passwd, 0, passwd.Length);\n\t\t\t\tthrow new AuthenticationException (\"Password too long.\");\n\t\t\t}\n\n\t\t\tvar buffer = new byte[user.Length + passwd.Length + 3];\n\t\t\tint n = 0;\n\n\t\t\tbuffer[n++] = 1;\n\t\t\tbuffer[n++] = (byte) user.Length;\n\t\t\tBuffer.BlockCopy (user, 0, buffer, n, user.Length);\n\t\t\tn += user.Length;\n\t\t\tbuffer[n++] = (byte) passwd.Length;\n\t\t\tBuffer.BlockCopy (passwd, 0, buffer, n, passwd.Length);\n\n\t\t\tArray.Clear (passwd, 0, passwd.Length);\n\n\t\t\treturn buffer;\n\t\t}\n\n\t\tvoid Authenticate (Socket socket, CancellationToken cancellationToken)","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Proxy/Socks5Client.cs#L230-L266","documentation":"Like the username, the RFC 1929 password field is limited to 255 UTF-8 bytes. GetAuthenticateCommand throws AuthenticationException when the encoded password is too long; it zeroes the password buffer before throwing to avoid leaving the secret in memory.","triggerScenarios":"Socks5Client.Connect/ConnectAsync with ProxyCredentials whose Password exceeds 255 UTF-8 bytes.","commonSituations":"Users pasting an access token or API key into the password field of a SOCKS5 credential, or very long generated passwords from a secret manager.","solutions":["Set a password of 255 UTF-8 bytes or less for the SOCKS5 account","If a long secret must be sent, switch to a mechanism that supports it (e.g. tunnel auth at a higher layer) or a different proxy auth scheme","Validate credential byte lengths at configuration load time to fail fast with a clearer message"],"exampleFix":"// before\ncredentials.Password = File.ReadAllText(\"token.txt\"); // 512-byte JWT\n// after\ncredentials.Password = config[\"Socks5:Password\"]; // <=255 bytes, set on the proxy server","handlingStrategy":"validation","validationCode":"if (Encoding.UTF8.GetByteCount(password) > 255)\n    throw new ArgumentException(\"SOCKS5 password must be <= 255 UTF-8 bytes.\", nameof(password));","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enforce a max password length when issuing SOCKS5 accounts","Store secrets of bounded length in the secret manager","Check byte length, not char count, for multi-byte secrets"],"tags":["socks5","authentication","credentials"],"backgroundTag":"authentication-required","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}