RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Thrown by 'getRoomByTypeAndName' when the caller is anonymous (Meteor.userAsync() yields no user _id) and anonymous read is not allowed: either the Accounts_AllowAnonymousRead setting is off, or the requested room type is not 'c' (public channel). Anonymous visitors may only read public channels, and only when the setting enables it.

Source

Thrown at apps/meteor/server/publications/room/index.ts:66

Meteor.methods<ServerMethods>({
	async 'rooms/get'(updatedAt) {
		return roomsGetMethod(Meteor.userId(), updatedAt);
	},

	async 'getRoomByTypeAndName'(type, name) {
		if (!type || !name) {
			throw new Meteor.Error('error-invalid-room', 'Invalid room', {
				method: 'getRoomByTypeAndName',
			});
		}

		const user = await Meteor.userAsync();
		const isAnonymous = !user?._id;

		if (isAnonymous) {
			const allowAnon = settings.get('Accounts_AllowAnonymousRead');
			if (!allowAnon || type !== 'c') {
				throw new Meteor.Error('error-invalid-user', 'Invalid user', {
					method: 'getRoomByTypeAndName',
				});
			}
		}

		const roomFind = roomCoordinator.getRoomFind(type);

		const room = roomFind ? await roomFind.call(this, name) : await Rooms.findByTypeAndNameOrId(type, name);

		if (!room) {
			throw new Meteor.Error('error-invalid-room', 'Invalid room', {
				method: 'getRoomByTypeAndName',
			});
		}

		if (
			user &&
			!(await canAccessRoomAsync(room, user, {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Enable Administration > General > Accounts_AllowAnonymousRead for public channel reads
2. Restrict anonymous lookups to type 'c'
3. Require login for private rooms and direct messages

Example fix

// before (anonymous, private room)
Meteor.call('getRoomByTypeAndName', 'p', 'secret');

// after: login first, or only fetch public channels when anonymous
if (!Meteor.userId()) {
  Meteor.call('getRoomByTypeAndName', 'c', 'general');
}

const anonOk = Settings.isTrue('Accounts_AllowAnonymousRead');
if (!Meteor.userId() && (!anonOk || roomType !== 'c')) {
  throw new Error('anonymous access requires Accounts_AllowAnonymousRead and a public channel');
}
Meteor.call('getRoomByTypeAndName', roomType, name);

function canAnonymousFetch(type: string, allowAnonRead: boolean): boolean {
  return allowAnonRead && type === 'c';
}

try { await Meteor.callAsync('getRoomByTypeAndName', type, name); } catch (e) { if (e.error === 'error-invalid-user') { /* prompt login or fall back to public channel */ } }

When it happens

Trigger: Unauthenticated DDP call to getRoomByTypeAndName('p', 'secret') (private room); any anonymous call while Accounts_AllowAnonymousRead is false.

Common situations: Embedding a public channel in a public site without enabling anonymous read; logged-out preview pages hitting private/direct rooms; sessions dropped by cookie policy so 'logged in' users appear anonymous.

Related errors

• error-action-not-allowed
• error-message-editing-blocked
• error-invalid-room
• error-invalid-user
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/9b2cbe9fe565714d. Report an issue: GitHub.