AlexxIT/go2rtc · warning

failed authentication

Error message

failed authentication

What it means

FailedAuth is the sentinel error (errors.New("failed authentication")) returned by an RTSP server-side Conn's Accept() when an incoming client fails authentication: Validate() returned invalid credentials and the request was not the benign first unauthenticated request (ffmpeg-style probe) that should just be retried. Callers detect it with errors.Is(err, rtsp.FailedAuth) to log a warning instead of a hard failure.

Solutions

1. Update the client's RTSP URL credentials to match the username/password configured in go2rtc (streams source rtsp://user:pass@...).
2. Check go2rtc config for the correct credentials and restart clients after changing them.
3. Treat FailedAuth specially with errors.Is to log a warning and continue accepting other clients instead of crashing the accept loop.
4. If clients legitimately need no auth, configure the stream/source to allow unauthenticated access rather than sending wrong credentials.

Example fix

// before
if err := conn.Accept(); err != nil {
    log.Error().Err(err).Msg("accept failed")
    return
}
// after
if err := conn.Accept(); err != nil {
    if errors.Is(err, rtsp.FailedAuth) {
        log.Warn().Str("remote_addr", conn.Connection.RemoteAddr).Msg("[rtsp] failed authentication")
        return
    }
    log.Error().Err(err).Msg("accept failed")
    return
}

// client side: ensure credentials match server config before dialing
if cfg.RTSPUser == "" || cfg.RTSPPass == "" {
    return errors.New("rtsp credentials must be configured")
}

if err := conn.Accept(); err != nil {
    if errors.Is(err, rtsp.FailedAuth) {
        log.Warn().Str("remote_addr", conn.Connection.RemoteAddr).Msg("[rtsp] failed authentication")
        return nil // keep server alive
    }
    return err
}

When it happens

Trigger: A client connects to the go2rtc RTSP server (internal/rtsp listener or NewServer) and sends requests with wrong/missing Authorization headers after the initial empty-credentials probe; c.auth.Validate fails non-empty, the server replies 401 once, and Accept() returns FailedAuth.

Common situations: VLC/ffmpeg client configured with wrong or outdated RTSP credentials; user removed/changed the password in go2rtc config but the client caches old credentials; a port scanner or misconfigured client hitting the RTSP port; credential mismatch between stream source config and go2rtc api config.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• wrong user/pass
• wrong request
• exec: rtsp module disabled
• exec: timeout
• loginResp.ErrorMsg

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/50216ccb4753b5c6. Report an issue: GitHub.

Appendix: source

Thrown at pkg/rtsp/server.go:16

package rtsp

import (
	"bufio"
	"errors"
	"fmt"
	"net"
	"net/url"
	"strconv"
	"strings"

	"github.com/AlexxIT/go2rtc/pkg/core"
	"github.com/AlexxIT/go2rtc/pkg/tcp"
)

var FailedAuth = errors.New("failed authentication")

func NewServer(conn net.Conn) *Conn {
	return &Conn{
		Connection: core.Connection{
			ID:         core.NewID(),
			FormatName: "rtsp",
			Protocol:   "rtsp+tcp",
			RemoteAddr: conn.RemoteAddr().String(),
		},
		conn:   conn,
		reader: bufio.NewReader(conn),
	}
}

func (c *Conn) Auth(username, password string) {
	info := url.UserPassword(username, password)
	c.auth = tcp.NewAuth(info)
}

View on GitHub (pinned to c245815e75)