archie.herbias -2 Newbie Poster

is it possible not to include the account password for the user that will send the email. i tried not to put password but it does not work. the email that can send only is the one that is set. please help. this is the code:

<%@ page import="java.io.*,java.util.*,javax.mail.*"%>
<%@ page import="javax.mail.internet.*,javax.activation.*"%>
<%@ page import="javax.servlet.http.*,javax.servlet.*" %>

<%

    String host="", user="", pass="";
    host = "smtp.gmail.com"; //"smtp.gmail.com";
    user = "email";  // email id to send the emails
    pass = "password"; //Your gmail password
    String SSL_FACTORY = "javax.net.ssl.SSLSocketFactory";
    String to = request.getParameter("to");// out going email id
    String from = user;// Email id of the sender/server
    String subject = "subject";
    String messageText = request.getParameter("body");
    boolean sessionDebug = true;
    Properties props = System.getProperties();
    props.put("mail.host", host);
    props.put("mail.transport.protocol.", "smtp");
    props.put("mail.smtp.auth", "true");
    props.put("mail.smtp.", "true");
    props.put("mail.smtp.port", "465");
    props.put("mail.smtp.socketFactory.fallback", "false");
    props.put("mail.smtp.socketFactory.class", SSL_FACTORY);
    Session mailSession = Session.getDefaultInstance(props, null);
    out.println("mailSession : " + mailSession);
    mailSession.setDebug(sessionDebug);
        Message msg = new MimeMessage(mailSession);
        msg.setFrom(new InternetAddress(from));
        InternetAddress[] address = {new InternetAddress(to)};
        msg.setRecipients(Message.RecipientType.TO, address);
        msg.setSubject(subject);
        msg.setContent(messageText, "text/html"); // use setText if you want to send text
        Transport transport = mailSession.getTransport("smtp");
        transport.connect(host, user, pass);
        try
    {
            transport.sendMessage(msg, msg.getAllRecipients());
            out.println("Email sent");
        }
        catch (Exception err)
    {
        err.printStackTrace();
        }
        transport.close();
%>

Dani AI

Generated

— the behaviour you saw is expected: a mail server will only let you send as a given account if you authenticate as that account or if the server explicitly delegates that right. Leaving a password blank simply means the server refuses the action, so only the configured credential can send.

Practical ways to solve this without asking every user for their mailbox password:

  • Send mail from the application’s own, verified address and set the user’s address in Reply-To so replies go to them. This avoids forging sender identities and keeps SPF/DKIM aligned.
  • Let users grant your app permission to send on their behalf via OAuth2; your app stores a refresh token and uses it to obtain access tokens when sending. Google supports this flow and also provides a direct send API as an alternative to SMTP (Google OAuth2 overview, Gmail API sending guide, Gmail Java quickstart).
  • Use a transactional email provider (API-based) and verify your sending domain; then set Reply-To to the user address. Providers such as SendGrid or Amazon SES are designed for server-side sending and deliverability (SendGrid docs).

Notes and troubleshooting: consumer Google accounts no longer allow “less secure app” password-only access, so OAuth2 or app-specific solutions are required (). If this is for an organization, consider a domain SMTP relay configured by the admin to permit sending without individual passwords (). Always avoid storing plain-text user passwords and monitor send logs and SPF/DKIM to prevent deliverability and spoofing problems.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.