{"record":{"id":"046484001fbc48b3","repo":"nats-io/nats-server","slug":"delete-must-be-enabled-in-server-config","errorCode":null,"errorMessage":"delete must be enabled in server config","messagePattern":"delete must be enabled in server config","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4369,"sourceCode":"\t\ts.Debugf(\"list request responded with %d account ids\", len(accIds))\n\t\tserver := &ServerInfo{}\n\t\tresponse := map[string]any{\"server\": server, \"data\": accIds}\n\t\ts.sendInternalMsgLocked(reply, _EMPTY_, server, response)\n\t}\n}\n\nfunc handleDeleteRequest(store *DirJWTStore, s *Server, msg []byte, reply string) {\n\tvar accIds []any\n\tvar subj, sysAccName string\n\tif sysAcc := s.SystemAccount(); sysAcc != nil {\n\t\tsysAccName = sysAcc.GetName()\n\t}\n\t// Only operator and operator signing key are allowed to delete\n\tgk, err := jwt.DecodeGeneric(string(msg))\n\tif err == nil {\n\t\tsubj = gk.Subject\n\t\tif store.deleteType == NoDelete {\n\t\t\terr = fmt.Errorf(\"delete must be enabled in server config\")\n\t\t} else if subj != gk.Issuer {\n\t\t\terr = fmt.Errorf(\"not self signed\")\n\t\t} else if _, ok := store.operator[gk.Issuer]; !ok {\n\t\t\terr = fmt.Errorf(\"not trusted\")\n\t\t} else if list, ok := gk.Data[\"accounts\"]; !ok {\n\t\t\terr = fmt.Errorf(\"malformed request\")\n\t\t} else if accIds, ok = list.([]any); !ok {\n\t\t\terr = fmt.Errorf(\"malformed request\")\n\t\t} else {\n\t\t\tfor _, entry := range accIds {\n\t\t\t\tif acc, ok := entry.(string); !ok ||\n\t\t\t\t\tacc == _EMPTY_ || !nkeys.IsValidPublicAccountKey(acc) {\n\t\t\t\t\terr = fmt.Errorf(\"malformed request\")\n\t\t\t\t\tbreak\n\t\t\t\t} else if acc == sysAccName {\n\t\t\t\t\terr = fmt.Errorf(\"not allowed to delete system account\")\n\t\t\t\t\tbreak\n\t\t\t\t}","sourceCodeStart":4351,"sourceCodeEnd":4387,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4351-L4387","documentation":"In the built-in account JWT resolver delete flow, a delete request received over the internal delete subject is validated against the store's delete policy. When store.deleteType is NoDelete (deletes not enabled in server config), the request is rejected with this error before any signature checks.","triggerScenarios":"Publishing a delete request JWT to the account resolver delete subject while the server is configured without deletes (delete not enabled), regardless of who signed it.","commonSituations":"Operator tooling issuing account deletes against a server whose resolver config lacks delete enablement; forgetting to add the delete config option when deploying delete-capable tooling.","solutions":["Enable deletes in the server resolver config (configure the allowed delete type, e.g. self-delete) and reload/restart","Remove/skip the delete request if deletes are intentionally disabled","Verify the store's deleteType before issuing delete requests from tooling"],"exampleFix":"// before\n// server.conf\nresolver: MEMORY\n// after\n// server.conf\nresolver: MEMORY\ndelete: Self (enable deletes per desired policy)","handlingStrategy":"validation","validationCode":"// client-side: only issue delete requests when server config enables deletes\nif resolverDeleteType == NoDelete {\n    return errors.New(\"refusing to send delete: deletes disabled in server config\")\n}\n","typeGuard":null,"tryCatchPattern":"if err := sendDeleteRequest(store, msg); err != nil {\n    if strings.Contains(err.Error(), \"delete must be enabled\") {\n        // notify operator to enable deletes or drop the request\n    }\n}\n","preventionTips":["Enable the delete policy in server config before deploying delete tooling","Check deleteType at startup in automation","Keep server config and tooling expectations in sync"],"tags":["nats-server","account-resolver","delete-policy","configuration"],"backgroundTag":"delete-not-enabled","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}