email: require STARTTLS and check the SMTP server identity (configurable) #73

New issue

Open

opened 2026-10-17 19:34:43 +00:00 by claude · 0 comments

claude commented

2026-10-17 19:34:43 +00:00

Member

Context

email/.../impl/apache/CommonsEmailNotificationService.scala:27 calls setStartTLSEnabled(true) only. Commons Email then uses STARTTLS when the server offers it and silently falls back to plain text when it does not (a downgrade an attacker on the path can force). The server certificate's host name is not checked. SMTPConfig has no setting for either.

MEDECA (production: mail.cmi.cz:587, authenticated with SMTP_USERNAME/SMTP_PASSWORD) must state encrypted communication between components to its client (ČMI acceptance of MEDH-158, finding 4), so the credentials must never travel in plain text.

Proposal

SMTPConfig: add smtp.starttls.required (Boolean) and smtp.ssl.checkServerIdentity (Boolean). Default both to true on port 587; keep false possible for local mock/dev servers on port 25 without TLS.
CommonsEmailNotificationService: setStartTLSRequired(...) and setSSLCheckServerIdentity(...) from the config.
Test against a local SMTP server that does not offer STARTTLS: with required = true, sending fails with a clear error instead of sending in plain text.

Related: SUPP-72 (CSRF token in the JS client, Secure session cookie).

## Context `email/.../impl/apache/CommonsEmailNotificationService.scala:27` calls `setStartTLSEnabled(true)` only. Commons Email then uses STARTTLS when the server offers it and silently falls back to plain text when it does not (a downgrade an attacker on the path can force). The server certificate's host name is not checked. `SMTPConfig` has no setting for either. MEDECA (production: `mail.cmi.cz:587`, authenticated with SMTP_USERNAME/SMTP_PASSWORD) must state encrypted communication between components to its client (ČMI acceptance of MEDH-158, finding 4), so the credentials must never travel in plain text. ## Proposal - `SMTPConfig`: add `smtp.starttls.required` (Boolean) and `smtp.ssl.checkServerIdentity` (Boolean). Default both to `true` on port 587; keep `false` possible for local mock/dev servers on port 25 without TLS. - `CommonsEmailNotificationService`: `setStartTLSRequired(...)` and `setSSLCheckServerIdentity(...)` from the config. - Test against a local SMTP server that does not offer STARTTLS: with `required = true`, sending fails with a clear error instead of sending in plain text. Related: SUPP-72 (CSRF token in the JS client, Secure session cookie).