OAUTH2 - SMTP ERROR: AUTH command failed: 334

[kilkujadek]

I hope I do not duplicate existing issues. I saw few similar problems, but I couldn't find working solution.

My code is working and I'm able to authenticate and send email through private and gSuite accounts successfully when scope for obtaining token is set to

$options = [ 'scope' => [ 'https://mail.google.com/' ] ];

Yet, I hope my app will be used not just by me, so I would like to limit scope to just sending emails. Changing it to:

$options = [ 'scope' => [ 'https://www.googleapis.com/auth/gmail.send' ] ];

still let me authorise app with gMail, but attempt to send email give me this:

2019-02-15 10:12:40 CLIENT -> SERVER: AUTH XOAUTH2 dXNlcj1rcnp5c3p0b2Yua3ViaWtAZ21haWwuY29tAWF1dGg9QmVhcmVyIHlhMjkuR2x1eEJxZGkzalF4MkVJaGdWMjZ4MWxvbEc3aUdoSTN4MjFSdEFXSzV2QmhTX0FkR0RodmlnSTEtSmd3dUIzTGU1QktaUUxkeTBSeno4UFlzUzNVZ3dYdlpReXdOTDZmTjVpNW9lai1xQXVtTWxERXZRdUFXTUk0OFB1MwEB
2019-02-15 10:12:40 SERVER -> CLIENT: 334 eyJzdGF0dXMiOiI0MDAiLCJzY2hlbWVzIjoiQmVhcmVyIiwic2NvcGUiOiJodHRwczovL21haWwuZ29vZ2xlLmNvbS8ifQ==
2019-02-15 10:12:40 SMTP ERROR: AUTH command failed: 334 eyJzdGF0dXMiOiI0MDAiLCJzY2hlbWVzIjoiQmVhcmVyIiwic2NvcGUiOiJodHRwczovL21haWwuZ29vZ2xlLmNvbS8ifQ==
2019-02-15 10:12:40 SMTP Error: Could not authenticate.
2019-02-15 10:12:40 CLIENT -> SERVER: QUIT
2019-02-15 10:12:40 SERVER -> CLIENT: 535-5.7.8 Username and Password not accepted. Learn more at
535 5.7.8 https://support.google.com/mail/?p=BadCredentials n184sm14639706wmf.5 - gsmtp
2019-02-15 10:12:40 SMTP ERROR: QUIT command failed: 535-5.7.8 Username and Password not accepted. Learn more at
535 5.7.8 https://support.google.com/mail/?p=BadCredentials n184sm14639706wmf.5 - gsmtp
2019-02-15 10:12:40 SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting
Mailer Error: SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/TroubleshootingSMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting

[AndreyNazarchuk]

Yes can we please work on this? this a security issue.

[Synchro]

It may well be a security issue, but it's gmail's security issue. PHPMailer simply uses whatever credentials you give it - the scope and whether they are accepted is up to gmail, not PHPMailer. Unless you can show a specific thing that PHPMailer is doing incorrectly, I don't think there is anything we can do from this end.

[ranjitatwal30]

A workaround I was able to successfully implement:

class GMailer extends PHPMailer
{

        public function __construct($exceptions = null)
        {
            parent::__construct($exceptions);
        }

        /**
         * Overrides parent send()
         *
         * @return boolean
         */
         public function send() {
            
            $client = new Google_Client();
            
            $client->setClientId($this->googleClientId);
            $client->setClientSecret($this->googleClientSecret);
            $client->setRedirectUri(XOAUTH_REDIRECT_URL);
            $client->addScope("https://www.googleapis.com/auth/gmail.send");
            $client->setAccessType('offline');
            $client->setApprovalPrompt('force');

            $client->refreshToken($this->googleRefreshToken);
            $newtoken = $client->getAccessToken();
            $client->setAccessToken($newtoken);
            
            $service = new Google_Service_Gmail($client);
            
            
            parent::preSend();
             
            
            $mime = rtrim(strtr(base64_encode($this->getSentMIMEMessage()), '+/', '-_'), '=');
            
            $msg = new Google_Service_Gmail_Message();
            
            $msg->setRaw($mime);
            
            return $service->users_messages->send("me", $msg);
         }
}