Resolving Error 535-5.7.8: Username and Password Not Accepted When Sending Gmail Emails with Nodemailer in Node.js

Problem Analysis and Background

When using the Nodemailer library in Node.js to send emails via Gmail's SMTP server, developers often encounter the Error: Invalid login: 535-5.7.8 Username and Password not accepted error. This error indicates authentication failure, but the underlying cause is usually not the code itself but Google account security settings. Below is a typical code snippet that triggers this error:

var nodemailer = require('nodemailer');

var transporter = nodemailer.createTransport({
  service: 'gmail',
  auth: {
    user: 'example@gmail.com',
    pass: '**********'
  }
});

var mailOptions = {
  from: 'example@gmail.com',
  to: 'recipient@gmail.com',
  subject: 'Test Email',
  text: 'This is a test message.'
};

transporter.sendMail(mailOptions, function(error, info){
  if (error) {
    console.log(error);
  } else {
    console.log('Email sent: ' + info.response);
  }
});

Despite correct logic, running this code returns a 535 error because Google blocks login attempts from "less secure apps" by default to protect user accounts from unauthorized access.

Solution 1: Enable Less Secure App Access

According to the best answer (score 10.0), the most straightforward solution is to allow less secure apps to access the Google account. This can be done via the Google account's "less secure apps" settings page. Steps include:

1. Log into your Google account.
2. Navigate to the less secure apps settings page.
3. Enable the "Allow less secure apps" option.

Once enabled, the above code should work. However, note that Google is phasing out this feature as it reduces account security, so this method may not be available for all accounts or in future updates.

Solution 2: Use App-Specific Passwords

As supplementary references, other answers suggest using app-specific passwords, a more secure alternative. App-specific passwords are 16-character passwords generated by Google for specific applications, eliminating the need for less secure app access. Configuration steps:

1. Ensure two-factor authentication (2FA) is enabled on your Google account.
2. Visit the app-specific passwords generation page.
3. Generate a password for your application (e.g., "Node.js Email Sender").
4. Replace the regular password in your code with the generated one.

Code modification example:

var transporter = nodemailer.createTransport({
  host: 'smtp.gmail.com',
  port: 465,
  secure: true,
  auth: {
    user: 'example@gmail.com',
    pass: 'generated-16-character-app-password'
  }
});

This method enhances security as app-specific passwords are limited to specific apps, and if compromised, do not endanger the main account.

Solution 3: Generate App Passwords with Two-Factor Authentication

Another detailed solution involves enabling two-factor authentication and generating app passwords. Steps include:

1. Access the Google account security page.
2. Enable two-factor authentication.
3. Find the "App passwords" option in the two-factor authentication settings (as of July 2023, located at the bottom of the page).
4. Select "Other" as the app type and enter a custom name (e.g., "mycustomapp").
5. Copy the generated password and use it in your code.

Complete code example:

const nodemailer = require('nodemailer');

const transporter = nodemailer.createTransport({
  service: 'gmail',
  host: 'smtp.gmail.com',
  port: 465,
  secure: true,
  auth: {
    user: 'example@gmail.com',
    pass: 'app-generated-password'
  }
});

const sendEmail = (email, token) => {
  const mailOptions = {
    from: 'example@gmail.com',
    to: email,
    subject: 'Email Verification',
    html: '<p>Please click on the following link to verify your email address:</p>' +
          '<a href="http://localhost:3000/verify/' + token + '">http://localhost:3000/verify/' + token + '</a>'
  };

  transporter.sendMail(mailOptions, function (error, info) {
    if (error) {
      console.log('Error in sending email: ' + error);
      return true;
    } else {
      console.log('Email sent: ' + info.response);
      return false;
    }
  });
};

module.exports = sendEmail;

This method aligns with modern security practices and is recommended for production environments.

Summary and Best Practices

The key to resolving the 535-5.7.8 error lies in understanding and adapting to Google's security policies. While enabling less secure apps is the quickest method, for security reasons, using app-specific passwords is advised. For high-security applications, enabling two-factor authentication and generating app passwords is the best approach. Developers should regularly check for updates to Google's security settings to ensure code compatibility. Additionally, always handle errors properly in code and provide clear logging for debugging. By following these practices, you can build reliable and secure email-sending functionality, avoiding common authentication issues.