{"record":{"id":"3ad324cbc28e4e89","repo":"nats-io/nats-server","slug":"authorized-user-on-account-q-using-invalid-connec","errorCode":null,"errorMessage":"authorized user on account %q using invalid connection type","messagePattern":"authorized user on account %q using invalid connection type","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth_callout.go","lineNumber":202,"sourceCode":"\t\t\t\treturn _EMPTY_, fmt.Errorf(\"account %q not permitted as valid account option for auth callout for account %q\",\n\t\t\t\t\tarc.Issuer, account)\n\t\t\t}\n\t\t}\n\t\treturn jwtIssuer, nil\n\t}\n\n\tgetExpirationAndAllowedConnections := func(arc *jwt.UserClaims, account string) (time.Duration, map[string]struct{}, error) {\n\t\tallowNow, expiration := validateTimes(arc)\n\t\tif !allowNow {\n\t\t\tc.Errorf(\"Outside connect times\")\n\t\t\treturn 0, nil, fmt.Errorf(\"authorized user on account %q outside of valid connect times\", account)\n\t\t}\n\n\t\tallowedConnTypes, err := convertAllowedConnectionTypes(arc.User.AllowedConnectionTypes)\n\t\tif err != nil {\n\t\t\tc.Debugf(\"%v\", err)\n\t\t\tif len(allowedConnTypes) == 0 {\n\t\t\t\treturn 0, nil, fmt.Errorf(\"authorized user on account %q using invalid connection type\", account)\n\t\t\t}\n\t\t}\n\t\treturn expiration, allowedConnTypes, nil\n\t}\n\n\tassignAccountAndPermissions := func(arc *jwt.UserClaims, account string) (*Account, error) {\n\t\t// Apply to this client.\n\t\tvar err error\n\t\tissuerAccount, err := getIssuerAccount(arc, account)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\t// if we are not in operator mode, they can specify placement as a tag\n\t\tvar placement string\n\t\tif !isOperatorMode {\n\t\t\t// only allow placement if we are not in operator mode\n\t\t\tplacement = arc.Audience","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth_callout.go#L184-L220","documentation":"convertAllowedConnectionTypes failed to parse the AllowedConnectionTypes in the auth callout's user JWT, and no valid connection types were produced, so the server rejects the user. AllowedConnectionTypes restricts which client protocols (e.g. \"STAN\", \"MQTT\", \"WEBSOCKET\", \"LEAF\") may use this user.","triggerScenarios":"The user JWT returned by the callout has User.AllowedConnectionTypes containing entries convertAllowedConnectionTypes cannot parse (unknown/misspelled type names), yielding err != nil and len(allowedConnTypes) == 0.","commonSituations":"Typo'd connection type strings (e.g. \"websocket\" casing/unknown value) in callout-generated claims; callout emitting an empty/garbage list where a parse error then leaves zero valid types.","solutions":["Use only recognized connection type values in AllowedConnectionTypes (e.g. WEBSOCKET, MQTT, STAN, LEAF as supported by the server).","Check the server debug log (c.Debugf \"%v\", err) for the exact parse error and fix the offending entry.","Remove the AllowedConnectionTypes field entirely if the user should be unrestricted."],"exampleFix":"// before\narc.User.AllowedConnectionTypes = []string{\"web-socket\"}\n// after\narc.User.AllowedConnectionTypes = []string{\"WEBSOCKET\"}","handlingStrategy":"validation","validationCode":"valid := map[string]bool{\"\": true, \"WEBSOCKET\": true, \"MQTT\": true, \"STAN\": true, \"LEAF\": true}\nfor _, t := range arc.User.AllowedConnectionTypes {\n    if !valid[t] {\n        return fmt.Errorf(\"unknown connection type %q\", t)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only emit connection type strings the server recognizes (exact casing).","Test callout-generated claims against convertAllowedConnectionTypes behavior.","Omit AllowedConnectionTypes when no restriction is intended."],"tags":["auth-callout","jwt","connection-types"],"backgroundTag":"jwt-claim-validation-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}