POP3 proxy should ignore client-supplied credentials #14

New Issue

2026-06-17T18:09:39+01:00

lyrathorpe commented

2026-06-17 18:09:39 +01:00

Summary

Some legacy POP3 clients require the user to enter a username and password and will not connect without them. The proxy does not need or use these per-client credentials: it always authenticates to the IMAP backend with its own configured account (BACKEND_IMAP_USER / BACKEND_IMAP_PASS).

Desired behaviour

USER and PASS from the client are accepted unconditionally (always +OK).
Client-supplied credentials are never validated or used for the backend connection.
The proxy always connects to the backend with the configured credentials.
If backend credentials are not configured, authentication fails with a clear configuration error rather than silently falling back to client credentials.

Note

This intentionally accepts any credentials at the POP3 listener. The listener is already documented as unauthenticated and is expected to run only on a trusted network. This is by design.

## Summary Some legacy POP3 clients require the user to enter a username and password and will not connect without them. The proxy does not need or use these per-client credentials: it always authenticates to the IMAP backend with its own configured account (`BACKEND_IMAP_USER` / `BACKEND_IMAP_PASS`). ## Desired behaviour - `USER` and `PASS` from the client are accepted unconditionally (always `+OK`). - Client-supplied credentials are never validated or used for the backend connection. - The proxy always connects to the backend with the configured credentials. - If backend credentials are not configured, authentication fails with a clear configuration error rather than silently falling back to client credentials. ## Note This intentionally accepts any credentials at the POP3 listener. The listener is already documented as unauthenticated and is expected to run only on a trusted network. This is by design.

lyrathorpe referenced a pull request that will close this issue

2026-06-17 18:10:05 +01:00

feat: ignore client-supplied POP3 credentials #15

lyrathorpe closed this issue

2026-06-17 18:16:38 +01:00

lyrathorpe referenced this issue from a commit

2026-06-17 18:16:39 +01:00

feat: ignore client-supplied POP3 credentials (#15)

Sign in to join this conversation.