{"record":{"id":"3fcc59530c26cc68","repo":"ekzhang/bore","slug":"server-requires-secret-but-no-secret-was-provided","errorCode":null,"errorMessage":"server requires secret, but no secret was provided","messagePattern":"server requires secret, but no secret was provided","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/auth.rs","lineNumber":62,"sourceCode":"            hmac.verify_slice(&tag).is_ok()\n        } else {\n            false\n        }\n    }\n\n    /// As the server, send a challenge to the client and validate their response.\n    pub async fn server_handshake<T: AsyncRead + AsyncWrite + Unpin>(\n        &self,\n        stream: &mut Delimited<T>,\n    ) -> Result<()> {\n        let challenge = Uuid::new_v4();\n        stream.send(ServerMessage::Challenge(challenge)).await?;\n        match stream.recv_timeout().await? {\n            Some(ClientMessage::Authenticate(tag)) => {\n                ensure!(self.validate(&challenge, &tag), \"invalid secret\");\n                Ok(())\n            }\n            _ => bail!(\"server requires secret, but no secret was provided\"),\n        }\n    }\n\n    /// As the client, answer a challenge to attempt to authenticate with the server.\n    pub async fn client_handshake<T: AsyncRead + AsyncWrite + Unpin>(\n        &self,\n        stream: &mut Delimited<T>,\n    ) -> Result<()> {\n        let challenge = match stream.recv_timeout().await? {\n            Some(ServerMessage::Challenge(challenge)) => challenge,\n            _ => bail!(\"expected authentication challenge, but no secret was required\"),\n        };\n        let tag = self.answer(&challenge);\n        stream.send(ClientMessage::Authenticate(tag)).await?;\n        Ok(())\n    }\n}\n","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/ekzhang/bore/blob/00a735a89917642df62d84336a90d9476fa175b5/src/auth.rs#L44-L80","documentation":"During `Authenticator::server_handshake`, the server sent a challenge and expected the client to reply with a `ClientMessage::Authenticate(tag)`. Instead, the first message received (or an EOF/timeout) was anything else, so the server cannot authenticate the connection. This library throws it because the server was started with a secret and will not accept unauthenticated clients.","triggerScenarios":"Client connected to a server started with `--secret` but the client never sent `Authenticate`: the client sent `Hello` directly (no secret configured on the client), sent some other unexpected message, or the connection closed/ephemeral message arrived before authentication.","commonSituations":"Server run with `bore server --secret mysecret` while the client omits `--secret`; mismatched client/server versions where one side does not authenticate; a proxy or misconfigured port forwarding stripping/reordering the handshake; a non-bore client (e.g. plain TCP scanner or health check) hitting the port.","solutions":["Start the client with the same secret as the server: `bore local <port> --to <host> --secret mysecret`.","If the server should not require auth, restart it without `--secret`.","Ensure client and server are the same bore version so the handshake protocol matches.","Check that nothing between client and server (proxy, tunnel) interferes with the framed protocol messages."],"exampleFix":"// before (server has --secret)\nbore local 3000 --to bore.example.com\n// after\nbore local 3000 --to bore.example.com --secret mysecret","handlingStrategy":"validation","validationCode":"// Before connecting, confirm the server requires a secret and you have one configured\nif server_requires_secret && client_secret.is_none() {\n    bail!(\"server requires --secret; provide the same secret as 'bore server --secret'\");\n}","typeGuard":null,"tryCatchPattern":"match Client::new(...).await {\n    Err(e) if e.to_string().contains(\"no secret was provided\") => configure_secret_and_retry(),\n    other => other,\n}","preventionTips":["Always pass --secret when the server was started with --secret.","Deploy client and server from the same configuration source so secrets stay in sync.","Document the secret requirement wherever the server endpoint is published."],"tags":["authentication","network","handshake"],"backgroundTag":"missing-credentials","analyzedSha":"00a735a89917642df62d84336a90d9476fa175b5","analyzedAt":"2026-09-08T13:27:32.996Z","contentChangedAt":"2026-09-08T13:27:32.996Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}