开发环境可发邮件，部署至Vercel后Nodemailer认证失败求助

用Node.js做后端、React.js做前端，通过Nodemailer调用Outlook SMTP服务发送邮件。开发环境下邮件可正常发送，但部署至Vercel后无法送达，已确认环境变量配置正确，Vercel日志显示535认证失败错误。

相关代码 #

const sendEmail = async({
  to,
  html,
  subject
}) => {
  const transporter = nodemailer.createTransport({
    host: "smtp-mail.outlook.com",
    port: 587,
    secure: false,
    auth: {
      user: process.env.EMAIL_USER,
      pass: process.env.EMAIL_PASS,
    }
  });
  const mailOptions = {
    from: process.env.EMAIL_USER,
    to,
    subject,
    html
  };
  try {
    await transporter.sendMail(mailOptions);
  } catch (error) {
    console.log(error);
  }
};

完整错误日志 #

Error: Invalid login: 535 5.7.3 Authentication unsuccessful
[CH5PR03CA0008.namprd03.prod.outlook.com 2024-05-30T11:35:24.043Z
08DC808625FCE55E] at SMTPConnection._formatError
(/var/task/server/node_modules/nodemailer/lib/smtp-connection/index.js:798:19)
at SMTPConnection._actionAUTHComplete
(/var/task/server/node_modules/nodemailer/lib/smtp-connection/index.js:1577:34)
at SMTPConnection.
(/var/task/server/node_modules/nodemailer/lib/smtp-connection/index.js:1531:18)
at SMTPConnection._processResponse
(/var/task/server/node_modules/nodemailer/lib/smtp-connection/index.js:982:20)
at SMTPConnection._onData
(/var/task/server/node_modules/nodemailer/lib/smtp-connection/index.js:763:14)
at SMTPConnection._onSocketData
(/var/task/server/node_modules/nodemailer/lib/smtp-connection/index.js:195:44)
at TLSSocket.emit (node:events:517:28) at addChunk
(node:internal/streams/readable:368:12) at readableAddChunk
(node:internal/streams/readable:341:9) at Readable.push
(node:internal/streams/readable:278:10) { code: 'EAUTH', response:
'535 5.7.3 Authentication unsuccessful
[CH5PR03CA0008.namprd03.prod.outlook.com 2024-05-30T11:35:24.043Z
08DC808625FCE55E]', responseCode: 535, command: 'AUTH LOGIN' }

• 启用Outlook应用密码：如果账户开启了两步验证，必须用应用密码代替原密码作为EMAIL_PASS。登录微软账户安全设置页，生成专属应用密码后替换Vercel环境变量。
• 解除账户安全拦截：微软可能把Vercel服务器IP识别为陌生地址，触发登录拦截。登录Outlook网页版，查看安全通知，手动允许该登录尝试或解除限制。
• 优化SMTP配置：在Nodemailer的createTransport配置中添加tls参数强制启用STARTTLS：

  tls: {
    ciphers: 'SSLv3'
  }
  

  或明确开启requireTLS：

  requireTLS: true
  

• 确认Vercel环境变量生效：可在代码中临时打印环境变量值（注意不要泄露敏感信息），部署后查看Vercel日志确认变量是否正确加载。若刚修改过变量，需重新发布项目确保生效。
• 切换OAuth2认证：改用微软OAuth2方式认证，需在微软Azure平台创建OAuth应用，配置客户端ID、密钥等信息，替换Nodemailer的auth配置为oauth2类型，避免密码认证的限制。

内容的提问来源于stack exchange，提问作者Olakunle Wonuola