FtpWebRequest ignores wrong password after previous successful connection using correct password

Question

I have run into an issue when working with FtpWebRequest class in C#.

When I try to upload a file to an FTP server using correct credentials for the first time and then wrong credentials (user name the same but wrong password) for the second time, there is no exception thrown and the file is still UPLOADED to the FTP server. Please consider the following code:

using System;
using System.Net;

internal class Program
{
    private static void Main(string[] args)
    {
        var uri = new Uri("ftp://ftp.dlptest.com/TestFile.txt");
        var method = WebRequestMethods.Ftp.UploadFile;

        //Here I'm uploading the test file using correct credentials
        var correctCredentials =
            new NetworkCredential("dlpuser@dlptest.com", "fwRhzAnR1vgig8s");
        DoFtpRequest(uri, correctCredentials, method);

        //Here I'm uploading the test file using wrong credentials.
        //I expect some exception to be thrown and the file not being
        //uploaded to the server, neither is the case.
        var wrongCredentials =
            new NetworkCredential("dlpuser@dlptest.com", "WRONG_PASWORD");
        DoFtpRequest(uri, wrongCredentials, method);
    }

    public static FtpWebResponse DoFtpRequest(
        Uri uri, NetworkCredential credentials, string method)
    {
        var request = (FtpWebRequest)WebRequest.Create(uri);
        request.Credentials = credentials;
        request.Method = method;
        return (FtpWebResponse)request.GetResponse();
    }
}

Here I am using a public ftp server ftp://ftp.dlptest.com/ that I found here https://dlptest.com/ftp-test/ which you can use to test this code.

As you can see first I try to upload a file with correct credentials and then with wrong credentials (using the same user name but changing the password). But the file is still uploaded to the server. If I try to use wrong credentials first, the exception is thrown, and everything works as expected.

Do you know what's going on? Is this a bug of the framework? What are my options to deal with this issue, because it causes problems with the program I'm working on now?

Martin Prikryl · Accepted Answer · 2021-06-07T09:40:37.040

FtpWebRequest uses a connection pool under the hood. See FTP multiple files in C# without reestablishing connection.

Keys to that connection pool are only hostname, port number, username and optional connection group name.

Your second request reuses a connection from the first request and never uses the wrong password. It's because these two requests use the same connection pool, as they differ by a password only, which is not part of the key.

While, if you swap the requests, the first request does not succeed, its connection is closed and does not make it to the pool. The second request has to start with a new connection, and it will use its correct password.

To isolate the requests you can:

Use a unique FtpWebRequest.ConnectionGroupName for different requests to make them use different connection pools.
Or disable FtpWebRequest.KeepAlive to disable connection pooling altogether.

FtpWebRequest ignores wrong password after previous successful connection using correct password

1 Answers1

Linked