{"record":{"id":"332734e083b35d3b","repo":"phalcon/cphalcon","slug":"failed-to-authenticate-with-the-redis-server","errorCode":null,"errorMessage":"Failed to authenticate with the Redis server","messagePattern":"Failed to authenticate with the Redis server","errorType":"exception","errorClass":"Phalcon\\Storage\\Exceptions\\AuthenticationFailed","httpStatus":null,"severity":"error","filePath":"phalcon/Storage/Adapter/Redis.zep","lineNumber":392,"sourceCode":"    /**\n     * @param RedisService $connection\n     *\n     * @throws AuthenticationFailed\n     */\n    private function checkAuth(<RedisService> connection) -> <static>\n    {\n        var auth, error;\n\n        let auth = this->options[\"auth\"];\n\n        try {\n            let error = (true !== empty(auth) && true !== connection->auth(auth));\n        } catch BaseException {\n            let error = true;\n        }\n\n        if error {\n            throw new AuthenticationFailed();\n        }\n\n        return this;\n    }\n\n    /**\n     * @throws ConnectionFailed\n     */\n    private function checkConnect(<RedisService> connection) -> <static>\n    {\n        var auth, connectionOptions, ex, host, method, options, parameter,\n            persistentId, port, retryInterval, readTimeout, result, ssl, timeout;\n\n        let options       = this->options,\n            host          = options[\"host\"],\n            port          = options[\"port\"],\n            timeout       = options[\"timeout\"],\n            retryInterval = options[\"retryInterval\"],","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Storage/Adapter/Redis.zep#L374-L410","documentation":"During lazy connect (first cache call), after checkConnect() succeeds, Phalcon\\Storage\\Adapter\\Redis calls Redis::auth() with options['auth'] (a password string, or ['user' => ..., 'password' => ...] for Redis 6 ACL). If auth() returns false or throws, Phalcon throws AuthenticationFailed with no detail payload.","triggerScenarios":"Wrong password in the 'auth' option; Redis 6+ ACL user with missing permissions but credentials passed in a format phpredis cannot map to AUTH/HELLO; requirepass/ACL changed after deploy; auth string accidentally containing the 'user:password' form while the server has no ACL user (it is then treated as one password).","commonSituations":"Credential rotation without updating the cache config; empty or wrong env var in one environment; switching from single-password Redis to ACL users without moving from string auth to the array form.","solutions":["Verify credentials out of band from the same host: redis-cli -h <host> -p <port> --user <user> -a <password> PING","For Redis 6+ ACL pass an array: ['auth' => ['user' => 'app', 'password' => 'secret']]","Ensure the ACL user has connection and key permissions on the selected index ('index' option)","Drop the 'auth' option entirely if the server has no authentication"],"exampleFix":"// before\nnew Redis($factory, ['auth' => 'app:secret']); // treated as one password -> AuthenticationFailed\n\n// after (Redis 6 ACL)\nnew Redis($factory, ['auth' => ['user' => 'app', 'password' => 'secret']]);","handlingStrategy":"try-catch","validationCode":"// fail fast at boot with a cheap round-trip before serving traffic\ntry {\n    $adapter->getAdapter(); // triggers connect + auth + select\n} catch (\\Phalcon\\Storage\\Exceptions\\AuthenticationFailed $e) {\n    $logger->critical('Redis auth failed — check the auth option and ACL user');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $value = $cache->get($key);\n} catch (\\Phalcon\\Storage\\Exceptions\\AuthenticationFailed $e) {\n    // wrong password or ACL format — do not retry, page a human\n    $logger->alert('Redis credentials rejected');\n    throw new ServiceUnavailableException('Cache unavailable', 0, $e);\n}","preventionTips":["Pass Redis 6+ ACL credentials as ['user' => ..., 'password' => ...], not a 'user:password' string","Rotate credentials through the same pipeline that redeploys config, and warm the cache at boot to catch auth errors early","Give the ACL user access to the database set in 'index'"],"tags":["php","phalcon","redis","cache","authentication"],"backgroundTag":"invalid-credentials","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}