--- a/src/imap/ngx_imap.h
+++ b/src/imap/ngx_imap.h
@@ -15,12 +15,20 @@ typedef struct {
 } ngx_imap_proxy_ctx_t;
 
 
+typedef enum {
+    ngx_pop3_start = 0,
+    ngx_pop3_user
+} ngx_imap_state_e;
+
+
 typedef struct {
     uint32_t                signature;         /* "IMAP" */
 
     ngx_connection_t       *connection;
     ngx_buf_t              *buffer;
 
+    ngx_imap_state_e        imap_state;
+
     ngx_imap_proxy_ctx_t   *proxy;
 
     ngx_uint_t              command;

--- a/src/imap/ngx_imap_handler.c
+++ b/src/imap/ngx_imap_handler.c
@@ -81,12 +81,15 @@ static void ngx_imap_init_session(ngx_ev
         return;
     }
 
+    c->read->event_handler = ngx_pop3_auth_state;
+
     ngx_pop3_auth_state(rev);
 }
 
 
 static void ngx_pop3_auth_state(ngx_event_t *rev)
 {
+    ngx_uint_t           quit;
     u_char              *text;
     ssize_t              size;
     ngx_int_t            rc;
@@ -96,6 +99,8 @@ static void ngx_pop3_auth_state(ngx_even
     c = rev->data;
     s = c->data;
 
+    ngx_log_debug0(NGX_LOG_DEBUG_IMAP, c->log, 0, "pop3 auth state");
+
     /* TODO: timeout */
 
     rc = ngx_pop3_read_command(s);
@@ -104,15 +109,68 @@ static void ngx_pop3_auth_state(ngx_even
         return;
     }
 
-    s->state = 0;
+    quit = 0;
+    text = pop3_ok;
+    size = sizeof(pop3_ok) - 1;
+
+    if (rc == NGX_OK) {
+        switch (s->imap_state) {
+
+        case ngx_pop3_start:
+
+            switch (s->command) {
+
+            case NGX_POP3_USER:
+                if (s->args.nelts == 1) {
+                    s->imap_state = ngx_pop3_user;
+                } else {
+                    rc = NGX_IMAP_PARSE_INVALID_COMMAND;
+                }
+
+                break;
+
+            case NGX_POP3_QUIT:
+                quit = 1;
+                break;
+
+            default:
+                s->imap_state = ngx_pop3_start;
+                rc = NGX_IMAP_PARSE_INVALID_COMMAND;
+                break;
+            }
+
+            break;
+
+        case ngx_pop3_user:
+
+            switch (s->command) {
+
+            case NGX_POP3_PASS:
+                if (s->args.nelts == 1) {
+                    /* STUB */ s->imap_state = ngx_pop3_start;
+                } else {
+                    rc = NGX_IMAP_PARSE_INVALID_COMMAND;
+                }
+
+                break;
+
+            case NGX_POP3_QUIT:
+                quit = 1;
+                break;
+
+            default:
+                s->imap_state = ngx_pop3_start;
+                rc = NGX_IMAP_PARSE_INVALID_COMMAND;
+                break;
+            }
+
+            break;
+        }
+    }
 
     if (rc == NGX_IMAP_PARSE_INVALID_COMMAND) {
         text = pop3_invalid_command;
         size = sizeof(pop3_invalid_command) - 1;
-
-    } else {
-        text = pop3_ok;
-        size = sizeof(pop3_ok) - 1;
     }
 
     if (ngx_send(c, text, size) < size) {
@@ -123,6 +181,15 @@ static void ngx_pop3_auth_state(ngx_even
         ngx_imap_close_connection(c);
         return;
     }
+
+    if (quit) {
+        ngx_imap_close_connection(c);
+        return;
+    }
+
+    s->args.nelts = 0;
+    s->buffer->pos = s->buffer->start;
+    s->buffer->last = s->buffer->start;
 }
 
 

--- a/src/imap/ngx_imap_parse.c
+++ b/src/imap/ngx_imap_parse.c
@@ -39,7 +39,7 @@ ngx_int_t ngx_pop3_parse_command(ngx_ima
                         s->command = NGX_POP3_USER;
 
                     } else if (c[0] == 'P' && c[1] == 'A'
-                               && c[2] == 'A' && c[3] == 'S')
+                               && c[2] == 'S' && c[3] == 'S')
                     {
                         s->command = NGX_POP3_PASS;
 
@@ -56,10 +56,12 @@ ngx_int_t ngx_pop3_parse_command(ngx_ima
 #endif
 
                     } else {
+                        s->state = sw_start;
                         return NGX_IMAP_PARSE_INVALID_COMMAND;
                     }
 
                 } else {
+                    s->state = sw_start;
                     return NGX_IMAP_PARSE_INVALID_COMMAND;
                 }
 
@@ -78,6 +80,7 @@ ngx_int_t ngx_pop3_parse_command(ngx_ima
             }
 
             if (ch < 'A' || ch > 'Z') {
+                s->state = sw_start;
                 return NGX_IMAP_PARSE_INVALID_COMMAND;
             }
 
@@ -98,6 +101,7 @@ ngx_int_t ngx_pop3_parse_command(ngx_ima
                 break;
             default:
                 if (s->args.nelts > 2) {
+                    s->state = sw_start;
                     return NGX_IMAP_PARSE_INVALID_COMMAND;
                 }
 
@@ -145,6 +149,7 @@ ngx_int_t ngx_pop3_parse_command(ngx_ima
                 state = sw_done;
                 break;
             default:
+                s->state = sw_start;
                 return NGX_IMAP_PARSE_INVALID_COMMAND;
             }
             break;
@@ -167,6 +172,7 @@ ngx_int_t ngx_pop3_parse_command(ngx_ima
             s->arg_start = NULL;
         }
 
+        s->state = sw_start;
         return NGX_OK;
 
     } else {