The JMAPACCESS Extension for IMAP
Extracted elements (15)
Message lifetime is unaffected by this extension: a message accessed via IMAP and then JMAP half a second later may have been deleted in between. The extension makes no consistency guarantees across protocol accesses.
Only complete equivalence between IMAP and JMAP mailstores is supported — the same set of messages must be available via both protocols. Partial equivalence is not supported to keep the extension simple.
The specification does not require mailboxes to have the same name in IMAP and JMAP even when they share a mailbox ID; naming is governed by the JMAP specification's name and role properties (RFC 8620, Section 2).
All JMAP servers support internationalized email addresses (RFC 6530). If the IMAP server does not, or if the client does not issue ENABLE UTF8=ACCEPT (RFC 6855), the client may receive accurate address fields via JMAP but downgraded fields via IMAP. Issuing ENABLE UTF8=ACCEPT sidesteps this issue.
The JMAPACCESS extension applies to both IMAP4rev1 (RFC 3501) and IMAP4rev2 (RFC 9051); the formal syntax is extended for both versions.
A server advertising JMAPACCESS MUST also advertise the OBJECTID extension (RFC 8474), ensuring that object IDs are shared between the IMAP and JMAP interfaces.
After processing LOGIN/AUTHENTICATE and entering Authenticated state, if the server can infer that the client's credentials suffice to authenticate via JMAP, it MUST include a JMAPACCESS capability in any capability list sent after that point, including any immediate post-authentication capability list.
If a JMAP server is known to the IMAP server, the server MUST respond to GETJMAPACCESS with an untagged JMAPACCESS response containing the JMAP session resource URL, followed by a tagged OK.
If no JMAP server is known, the server MUST respond to GETJMAPACCESS with a tagged BAD response and MUST NOT include JMAPACCESS in the capability list.
The GETJMAPACCESS command requests that the server respond with the session URL for the JMAP server providing access to the same mail. It is a new command valid in Authenticated state.
The JMAPACCESS capability is an IMAP extension that allows a server to declare that its mailstore is also accessible via JMAP, with complete object ID equivalence: if a mailbox or message has a particular object ID in IMAP or JMAP, the same object is accessible via the other protocol with the same ID.
The JMAPACCESS untagged response contains a single quoted string: the URL of the JMAP session resource that provides access to the same messages as the current IMAP connection.
IANA has added the JMAPACCESS capability to the 'Internet Message Access Protocol (IMAP) Capabilities Registry', with RFC 9698 listed as the reference.
JMAPACCESS reveals to authenticated IMAP clients that their credentials also work for JMAP and that object IDs match. However, since the client is already authenticated, the attacker already has valid credentials, and RFC 8620 Section 2.2 already discloses how to find the JMAP session URL without this extension. The migration value is considered to far outweigh the marginal risk.
The JMAPACCESS response has the formal syntax: `resp-jmapaccess = "JMAPACCESS" SP quoted`, where `quoted` is the JMAP session resource URL using IMAP quoted string encoding. It is added to `mailbox-data` and `command-auth` is extended with `"GETJMAPACCESS"`.