{"record":{"id":"058c6a0d599c0082","repo":"nats-io/nats-server","slug":"proxy-username-and-password-must-both-be-specified","errorCode":null,"errorMessage":"proxy username and password must both be specified or both be empty","messagePattern":"proxy username and password must both be specified or both be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":416,"sourceCode":"\tproxyURL, err := url.Parse(remote.Proxy.URL)\n\tif err != nil {\n\t\treturn warnings, fmt.Errorf(\"invalid proxy URL: %v\", err)\n\t}\n\n\tif proxyURL.Scheme != \"http\" && proxyURL.Scheme != \"https\" {\n\t\treturn warnings, fmt.Errorf(\"proxy URL scheme must be http or https, got: %s\", proxyURL.Scheme)\n\t}\n\n\tif proxyURL.Host == _EMPTY_ {\n\t\treturn warnings, fmt.Errorf(\"proxy URL must specify a host\")\n\t}\n\n\tif remote.Proxy.Timeout < 0 {\n\t\treturn warnings, fmt.Errorf(\"proxy timeout must be >= 0\")\n\t}\n\n\tif (remote.Proxy.Username == _EMPTY_) != (remote.Proxy.Password == _EMPTY_) {\n\t\treturn warnings, fmt.Errorf(\"proxy username and password must both be specified or both be empty\")\n\t}\n\n\tif len(remote.URLs) > 0 {\n\t\thasWebSocketURL := false\n\t\thasNonWebSocketURL := false\n\n\t\tfor _, remoteURL := range remote.URLs {\n\t\t\tif remoteURL.Scheme == wsSchemePrefix || remoteURL.Scheme == wsSchemePrefixTLS {\n\t\t\t\thasWebSocketURL = true\n\t\t\t\tif (remoteURL.Scheme == wsSchemePrefixTLS) &&\n\t\t\t\t\tremote.TLSConfig == nil && !remote.TLS {\n\t\t\t\t\treturn warnings, fmt.Errorf(\"proxy is configured but remote URL %s requires TLS and no TLS configuration is provided. When using proxy with TLS endpoints, ensure TLS is properly configured for the leafnode remote\", remoteURL.String())\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\thasNonWebSocketURL = true\n\t\t\t}\n\t\t}\n","sourceCodeStart":398,"sourceCodeEnd":434,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L398-L434","documentation":"Proxy credentials are half-specified: exactly one of username or password is empty. The validation requires both to be set or both empty, because a proxy auth header with only one credential is never valid and almost always indicates a config mistake.","triggerScenarios":"remote.Proxy with Username set but Password empty (or vice versa) in a leafnodes remote config, e.g. proxy { username: \"user\" } with no password field, or programmatic RemoteLeafOption Proxy with only one credential populated.","commonSituations":"Password left in an env var that failed to load (empty at runtime); someone redacting/removing the password from config for security and leaving the username; partial secret mounting in Kubernetes where one key is missing.","solutions":["Provide both proxy username and password in the remote config","If the proxy needs no auth, remove both fields","Verify the secret/env source actually supplies both values at server start"],"exampleFix":"// before\nproxy {\n  url: \"http://proxy:3128\"\n  username: \"user\"\n}\n// after\nproxy {\n  url: \"http://proxy:3128\"\n  username: \"user\"\n  password: \"pass\"\n}","handlingStrategy":"validation","validationCode":"p := cfg.Proxy\nif p != nil && (p.Username == \"\") != (p.Password == \"\") {\n    return fmt.Errorf(\"proxy username and password must both be set or both empty\")\n}","typeGuard":"func proxyCredsComplete(p *ProxyOptions) bool {\n    return p == nil || (p.Username == \"\") == (p.Password == \"\")\n}","tryCatchPattern":"if err := parseRemoteLeafNodes(cfg); err != nil {\n    log.Fatalf(\"leafnode remote rejected: %v\", err)\n}","preventionTips":["Store both credentials together in one secret","Verify secret mounts/env loads before server start","If auth is unneeded, remove both fields, not just the password"],"tags":["configuration","leafnode","proxy","authentication"],"backgroundTag":"incomplete-credentials","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}