{"record":{"id":"19f2e362f18a6ef3","repo":"nats-io/nats-server","slug":"default-js-domain-contains-account-q-with-invalid","errorCode":null,"errorMessage":"default_js_domain contains account %q with invalid domain name %q","messagePattern":"default_js_domain contains account %q with invalid domain name %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jetstream.go","lineNumber":2923,"sourceCode":"\t\t\tfor a := range o.JsAccDefaultDomain {\n\t\t\t\tif !nkeys.IsValidPublicAccountKey(a) {\n\t\t\t\t\treturn fmt.Errorf(\"default_js_domain contains account name %q, which is not a valid public account nkey\", a)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tfor a, d := range o.JsAccDefaultDomain {\n\t\t\tsacc := DEFAULT_SYSTEM_ACCOUNT\n\t\t\tif o.SystemAccount != _EMPTY_ {\n\t\t\t\tsacc = o.SystemAccount\n\t\t\t}\n\t\t\tif a == sacc {\n\t\t\t\treturn fmt.Errorf(\"system account %q can not be in default_js_domain\", a)\n\t\t\t}\n\t\t\tif d == _EMPTY_ {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif sub := fmt.Sprintf(jsDomainAPI, d); !IsValidSubject(sub) {\n\t\t\t\treturn fmt.Errorf(\"default_js_domain contains account %q with invalid domain name %q\", a, d)\n\t\t\t}\n\t\t}\n\t}\n\tif o.JetStreamDomain != _EMPTY_ {\n\t\tif subj := fmt.Sprintf(jsDomainAPI, o.JetStreamDomain); !IsValidSubject(subj) {\n\t\t\treturn fmt.Errorf(\"invalid domain name: derived %q is not a valid subject\", subj)\n\t\t}\n\n\t\tif !isValidName(o.JetStreamDomain) {\n\t\t\treturn fmt.Errorf(\"invalid domain name: may not contain ., * or >\")\n\t\t}\n\t}\n\t// If not clustered no checks needed past here.\n\tif !o.JetStream || o.Cluster.Port == 0 {\n\t\treturn nil\n\t}\n\tif o.ServerName == _EMPTY_ {\n\t\treturn fmt.Errorf(\"jetstream cluster requires `server_name` to be set\")","sourceCodeStart":2905,"sourceCodeEnd":2941,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jetstream.go#L2905-L2941","documentation":"JetStream domain names are embedded into API subjects via jsDomainAPI, so each domain in jsacc_default_domain must produce a valid NATS subject. The server validates every non-empty domain with IsValidSubject and rejects the config when the derived subject is invalid (e.g. domain contains spaces, illegal characters, or wildcard tokens in bad positions).","triggerScenarios":"A `jsacc_default_domain` entry with a non-empty domain value that fails IsValidSubject after fmt.Sprintf(jsDomainAPI, d) — e.g. domain containing whitespace, `*`/`>` wildcards used incorrectly, or empty subject tokens.","commonSituations":"Typo or stray space in a domain name in the config file; copy-pasting a domain containing trailing whitespace; using wildcard characters in a domain name believing they are allowed.","solutions":["Fix the offending domain value in `jsacc_default_domain` so it forms a valid NATS subject token (alphanumerics, underscores, hyphens, dots, no spaces).","Trim whitespace from the domain value in the config file.","Remove the entry entirely if the domain is not actually needed."],"exampleFix":"// before\njsacc_default_domain: {\n  \"APP\": \"my domain\"\n}\n// after\njsacc_default_domain: {\n  \"APP\": \"my-domain\"\n}","handlingStrategy":"validation","validationCode":"for acc, domain := range cfg.JsAccDefaultDomain {\n    if domain == \"\" { continue }\n    sub := \"$JS.\" + domain + \".API\" // mimic jsDomainAPI derivation\n    if !nats.IsValidSubject(sub) {\n        return fmt.Errorf(\"account %s domain %q invalid\", acc, domain)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Restrict domain names to [A-Za-z0-9_-] characters.","Trim whitespace from config values at generation time.","Never use * or > in domain names."],"tags":["jetstream","configuration","domain","subject-validation"],"backgroundTag":"invalid-server-config","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}