pocketbase/pocketbase · error

unencrypted connection

Error message

unencrypted connection

What it means

Error "unencrypted connection" thrown in pocketbase/pocketbase.

Source

Thrown at tools/mailer/smtp.go:192

// Otherwise authentication will fail with an error, without sending the credentials.
//
// [1]: https://github.com/golang/go/issues/40817
// [2]: https://support.microsoft.com/en-us/office/outlook-com-no-longer-supports-auth-plain-authentication-07f7d5e9-1697-465f-84d2-4513d4ff0145?ui=en-us&rs=en-us&ad=us
type smtpLoginAuth struct {
	username, password string
}

// Start initializes an authentication with the server.
//
// It is part of the [smtp.Auth] interface.
func (a *smtpLoginAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
	// Must have TLS, or else localhost server.
	// Note: If TLS is not true, then we can't trust ANYTHING in ServerInfo.
	// In particular, it doesn't matter if the server advertises LOGIN auth.
	// That might just be the attacker saying
	// "it's ok, you can trust me with your password."
	if !server.TLS && !isLocalhost(server.Name) {
		return "", nil, errors.New("unencrypted connection")
	}

	return "LOGIN", nil, nil
}

// Next "continues" the auth process by feeding the server with the requested data.
//
// It is part of the [smtp.Auth] interface.
func (a *smtpLoginAuth) Next(fromServer []byte, more bool) ([]byte, error) {
	if more {
		switch strings.ToLower(string(fromServer)) {
		case "username:":
			return []byte(a.username), nil
		case "password:":
			return []byte(a.password), nil
		}
	}

View on GitHub (pinned to 5d217ddb50)

Solutions

1. Enable TLS/STARTTLS on the SMTP connection (use port 465 with TLS or 587 with STARTTLS).
2. Only allow plaintext auth on trusted local networks and explicitly opt in to insecure connections.
3. Verify the SMTP server supports STARTTLS with `openssl s_client -starttls smtp -connect host:587`.

Example fix

m := mailer.NewSMTP("smtp.example.com", 587, user, pass)
m.TLSConfig = &tls.Config{ServerName: "smtp.example.com", MinVersion: tls.VersionTLS12}

When it happens

Trigger: Thrown when LOGIN SMTP auth is attempted over a connection that is neither TLS-encrypted nor to a localhost server, because credentials would be sent in plaintext.

Common situations: The SMTP server does not support STARTTLS/TLS, or TLS was not negotiated before auth. Enable TLS on the SMTP server or use an auth mechanism safe for the connection.

AI-assisted analysis of pocketbase/pocketbase@5d217ddb50 (2026-08-15). Data as JSON: /api/errors/bc1f47e8dc99af8d. Report an issue: GitHub.