{"record":{"id":"e231053fb11381ef","repo":"jstedfast/MailKit","slug":"failed-to-authenticate-with-socks5-proxy-server","errorCode":null,"errorMessage":"Failed to authenticate with SOCKS5 proxy server.","messagePattern":"Failed to authenticate with SOCKS5 proxy server\\.","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Proxy/Socks5Client.cs","lineNumber":280,"sourceCode":"\n\t\t\treturn buffer;\n\t\t}\n\n\t\tvoid Authenticate (Socket socket, CancellationToken cancellationToken)\n\t\t{\n\t\t\tvar buffer = GetAuthenticateCommand ();\n\n\t\t\tSend (socket, buffer, 0, buffer.Length, cancellationToken);\n\n\t\t\tint nread, n = 0;\n\n\t\t\tdo {\n\t\t\t\tif ((nread = Receive (socket, buffer, 0 + n, 2 - n, cancellationToken)) > 0)\n\t\t\t\t\tn += nread;\n\t\t\t} while (n < 2);\n\n\t\t\tif (buffer[1] != (byte) Socks5Reply.Success)\n\t\t\t\tthrow new AuthenticationException (\"Failed to authenticate with SOCKS5 proxy server.\");\n\t\t}\n\n\t\tasync Task AuthenticateAsync (Socket socket, CancellationToken cancellationToken)\n\t\t{\n\t\t\tvar buffer = GetAuthenticateCommand ();\n\n\t\t\tawait SendAsync (socket, buffer, 0, buffer.Length, cancellationToken).ConfigureAwait (false);\n\n\t\t\tint nread, n = 0;\n\n\t\t\tdo {\n\t\t\t\tif ((nread = await ReceiveAsync (socket, buffer, 0 + n, 2 - n, cancellationToken).ConfigureAwait (false)) > 0)\n\t\t\t\t\tn += nread;\n\t\t\t} while (n < 2);\n\n\t\t\tif (buffer[1] != (byte) Socks5Reply.Success)\n\t\t\t\tthrow new AuthenticationException (\"Failed to authenticate with SOCKS5 proxy server.\");\n\t\t}","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Proxy/Socks5Client.cs#L262-L298","documentation":"After sending the RFC 1929 username/password request, the synchronous Authenticate reads the 2-byte reply; any status byte other than 0x00 (Success) means the proxy rejected the credentials, so an AuthenticationException is thrown. Note the reply code itself is discarded — the message is intentionally generic.","triggerScenarios":"Socks5Client.Connect (sync) with ProxyCredentials whose username/password do not match an account the proxy accepts, or the proxy chose the username/password method but the server later rejects the values.","commonSituations":"Rotated or expired proxy credentials not updated in app config, wrong user for that proxy (multiple proxies), accounts locked by the proxy admin, or credentials for a different proxy environment (staging vs production).","solutions":["Verify the username/password against the proxy admin or provider dashboard and update ProxyCredentials","Test the same credentials with curl --socks5 -U user:pass to isolate client vs server","Check for credential rotation/secrets-manager drift; redeploy with current secrets"],"exampleFix":"// before\nproxy.ProxyCredentials = new NetworkCredential(oldUser, oldPass);\nproxy.Connect(uri);\n// after\nproxy.ProxyCredentials = new NetworkCredential(secrets[\"socks5:user\"], secrets[\"socks5:pass\"]); // refreshed\nproxy.Connect(uri);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    socks5.Connect(proxyHost, proxyPort, target, targetPort);\n} catch (AuthenticationException) {\n    log.Error(\"SOCKS5 credentials rejected for {0}:{1}\", proxyHost, proxyPort);\n    // alert ops: refresh credentials; do not retry blindly (proxy may lock account)\n}","preventionTips":["Refresh proxy credentials from the secret manager at deploy time","Trim whitespace when reading secrets from env/files","Test credentials with curl --socks5 -U in CI health checks"],"tags":["socks5","authentication","proxy"],"backgroundTag":"authentication-failed","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}