RocketChat/Rocket.Chat · error · MeteorError

error-input-is-not-a-valid-field

error-input-is-not-a-valid-field

Error message

${escape(userData.username)} is not a valid username

What it means

Thrown by validateUserData() when a submitted username fails the regex built from the UTF8_User_Names_Validation setting (escaped into ^...$; if the setting is an invalid regex the server falls back to ^[0-9a-zA-Z-_.]+$). The message interpolates the escaped username. It applies to creates AND updates whenever a username is present, and runs before availability checks.

Source

Thrown at apps/meteor/server/lib/users/saveUser/validateUserData.ts:79

	}

	if (!isUpdateUserData(userData) && !trim(userData.username)) {
		throw new MeteorError('error-the-field-is-required', 'The field Username is required', {
			method: 'insertOrUpdateUser',
			field: 'Username',
		});
	}

	let nameValidation;

	try {
		nameValidation = new RegExp(`^${settings.get('UTF8_User_Names_Validation')}$`);
	} catch (e) {
		nameValidation = new RegExp('^[0-9a-zA-Z-_.]+$');
	}

	if (userData.username && !nameValidation.test(userData.username)) {
		throw new MeteorError('error-input-is-not-a-valid-field', `${escape(userData.username)} is not a valid username`, {
			method: 'insertOrUpdateUser',
			input: userData.username,
			field: 'Username',
		});
	}

	if (!isUpdateUserData(userData) && !userData.password && !userData.setRandomPassword) {
		throw new MeteorError('error-the-field-is-required', 'The field Password is required', {
			method: 'insertOrUpdateUser',
			field: 'Password',
		});
	}

	if (!isUpdateUserData(userData)) {
		if (userData.username && !(await checkUsernameAvailability(userData.username))) {
			throw new MeteorError('error-field-unavailable', `${escape(userData.username)} is already in use :(`, {
				method: 'insertOrUpdateUser',
				field: userData.username,

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Match the client-side rule to the server setting: test the username against the same regex before submitting.
  2. If unicode usernames should be allowed, set UTF8_User_Names_Validation (Administration -> General -> UTF8 or via PATCH /api/v1/settings/UTF8_User_Names_Validation) to a permissive class such as '[0-9a-zA-Z-_.\p{L}]+' where supported.
  3. Normalize the input: trim and strip characters outside the allowed class (commonly replacing spaces with dots or dashes).

Example fix

// before
await POST '/api/v1/users.create', { username: 'joão sousa', ... }); // throws with default ASCII validation

// after (client-side guard + sanitized value)
const USERNAME_RE = /^[0-9a-zA-Z-_.]+$/;
const username = 'joão sousa'.normalize('NFKD').replace(/[^0-9a-zA-Z-_.]/g, '').slice(0, 22);
if (!USERNAME_RE.test(username)) throw new Error('invalid username');
await POST '/api/v1/users.create', { username: 'joaosousa', ... });
Defensive patterns

Strategy: validation

Validate before calling

const pattern = settings.get('UTF8_User_Names_Validation') ?? '[0-9a-zA-Z-_.]+';
let re: RegExp;
try { re = new RegExp(`^${pattern}$`); } catch { re = /^[0-9a-zA-Z-_.]+$/; }
if (payload.username && !re.test(payload.username)) throw new Error('invalid username');

Type guard

const isValidUsername = (u: string, re: RegExp) => re.test(u);

Try / catch

catch (e) {
  if (e.error === 'error-input-is-not-a-valid-field' && e.details?.field === 'Username') {
    // sanitize (strip illegal chars) and resubmit once
  }
}

Prevention

When it happens

Trigger: Username with spaces, accented/unicode characters, or symbols like '@' while UTF8_User_Names_Validation is the default ASCII class '[0-9a-zA-Z-_.]+'; admin widened/narrowed the setting and existing clients still validate against the old rule; a username that merely starts or ends with a character outside the class (the pattern is anchored ^...$).

Common situations: Workspace for non-Latin alphabets (e.g. Cyrillic or CJK usernames) without updating the setting; import scripts carrying over usernames from another system with different rules; trailing whitespace inside the username (trim only guards the required-check, and the class here does not include spaces).

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/4c3ff99c3a197c88. Report an issue: GitHub.