Question

We have an application that prompts the user to login using his ldap username and password, from that I can get the user email but not the email password, My goal is to send email from this user’s mail without the need to prompt the user for his email password.

I am using the following code to send email

NetworkCredential loginInfo = new NetworkCredential("[e-mail]","mypassword");
MailMessage msg = new MailMessage();
sg.From = new MailAddress("[e-mail]");
msg.To.Add(new MailAddress("[e-mail]"));
msg.Subject = "test";

SmtpClient client = new SmtpClient("smtp.mydomain.com");
client.EnableSsl = true;
client.UseDefaultCredentials = true;
client.Credentials = loginInfo;
client.Send(msg);

IS is is possible to send email without password? some thing like email spoofing, If not possilbe, is it possible to fake it, like send all emails form one email, but make the email look as if it is coming from the logged in user’s email?

Thanks

Answer 1

It all depends on the SMTP server. When you configure the SMTP server you decide what credentials it accepts and whether it allows you to pretend to be someone you’re not. Many web-servers have a built in SMTP server at localhost which usually doesn’t require any credentials. Some ISPs provide an SMTP server which allows you to send email from other people. If your SMTP server does not require authentication you can simply remove the 3 lines of code which configure security for the smtp client.