RocketChat/Rocket.Chat · error · Meteor.Error

error-blocked-username

error-blocked-username

Error message

`${_.escape(username)} is blocked and can't be used!`

What it means

checkUsernameAvailability throws error-blocked-username (method 'checkUsernameAvailability', field = the attempted username) when the name is reserved or malformed: usernameIsBlocked matches the blacklist built from ['all', 'here'] plus Accounts_BlockedUsernameList, or validateName rejects the format. Note the same error covers both cases, so the message 'is blocked and can't be used' can also mean 'fails the username format rules'.

Source

Thrown at apps/meteor/server/lib/users/checkUsernameAvailability.ts:46

	const user = await Users.findOneById(userId, { projection: { username: 1 } });

	if (!user) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'setUsername' });
	}

	if (user.username && !settings.get('Accounts_AllowUsernameChange')) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'setUsername' });
	}

	if (user.username === username) {
		return true;
	}
	return checkUsernameAvailability(username);
};

export const checkUsernameAvailability = async function (username: string, type: UsernameAvailabilityCheckType = 'user'): Promise<boolean> {
	if (usernameIsBlocked(username, usernameBlackList) || !validateName(username)) {
		throw new Meteor.Error('error-blocked-username', `${_.escape(username)} is blocked and can't be used!`, {
			method: 'checkUsernameAvailability',
			field: username,
		});
	}

	// Make sure no users are using this username
	const existingUser = await Users.findOneByUsernameIgnoringCase(username, {
		projection: { _id: 1 },
	});
	if (existingUser) {
		return false;
	}

	// Make sure no teams are using this username
	const existingTeam = await Team.getOneByName(toRegExp(username), { projection: { _id: 1 } });
	if (existingTeam) {
		return false;
	}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Pick a different username: anything matching the blocked list or the format rules will always fail
  2. Check the Admin > Settings > Accounts > Blocked Username List for entries that accidentally match legitimate names (entries are comma-separated and matched case-insensitively as full-string regexes)
  3. Run the same checks client-side before submitting: validateName(username) plus your own copy of the blocked list

Example fix

// before
Meteor.call('setUsername', username); // 'all' -> error-blocked-username

// after
const RESERVED = [/^all$/i, /^here$/i];
const isValidFormat = /^[a-zA-Z0-9._-]+$/.test(username); // mirror your username policy
if (!username || RESERVED.some((r) => r.test(username)) || !isValidFormat) {
  showFieldError('This username is reserved or invalid');
} else {
  Meteor.call('setUsername', username);
}
Defensive patterns

Strategy: validation

Validate before calling

const RESERVED = [/^all$/i, /^here$/i];
const passesFormat = /^[a-zA-Z0-9._-]+$/.test(username);
if (!username || RESERVED.some((r) => r.test(username)) || !passesFormat) {
  throw new Error('Username is reserved or invalid');
}
return checkUsernameAvailability(username);

Type guard

const isBlockedUsernameError = (e: unknown): boolean =>
  typeof e === 'object' && e !== null && (e as { error?: unknown }).error === 'error-blocked-username';

Try / catch

try {
  await checkUsernameAvailability(username);
} catch (e) {
  if (isBlockedUsernameError(e)) {
  	suggestAlternative(username); // error covers BOTH reserved words and format failures
  }
}

Prevention

When it happens

Trigger: Choosing 'all', 'here', or any entry listed in Accounts_BlockedUsernameList; using characters that fail validateName (emoji, symbols, invalid UTF-8 sequences, leading/trailing punctuation); brand names an admin reserved via the blacklist setting.

Common situations: Registration or username-change form accepting anything client-side; admins adding reserved words (admin, support, root) to the blocked list later, breaking existing signup flows that suggest such names; usernames imported from another system with exotic characters.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/801a6ef8486b89c2. Report an issue: GitHub.