{"record":{"id":"46c357e2a081f4de","repo":"phacility/phabricator","slug":"1045","errorCode":"1045","errorMessage":"#%d: %s","messagePattern":"#%d: %s","errorType":"exception","errorClass":"AphrontInvalidCredentialsQueryException","httpStatus":null,"severity":"error","filePath":"src/infrastructure/storage/connection/mysql/AphrontBaseMySQLDatabaseConnection.php","lineNumber":362,"sourceCode":"        // portable to parse the key out of the error and attach it to the\n        // exception.\n        throw new AphrontDuplicateKeyQueryException($message);\n      case 1044: // Access denied to database\n      case 1142: // Access denied to table\n      case 1143: // Access denied to column\n      case 1227: // Access denied (e.g., no SUPER for SHOW SLAVE STATUS).\n\n        // See T13622. Try to help users figure out that this is a GRANT\n        // problem.\n\n        $more = pht(\n          'This error usually indicates that you need to \"GRANT\" the '.\n          'MySQL user additional permissions. See \"GRANT\" in the MySQL '.\n          'manual for help.');\n\n        throw new AphrontAccessDeniedQueryException(\"{$message}\\n\\n{$more}\");\n      case 1045: // Access denied (auth)\n        throw new AphrontInvalidCredentialsQueryException($message);\n      case 1146: // No such table\n      case 1049: // No such database\n      case 1054: // Unknown column \"...\" in field list\n        throw new AphrontSchemaQueryException($message);\n    }\n\n    // TODO: 1064 is syntax error, and quite terrible in production.\n\n    return null;\n  }\n\n  protected function throwConnectionException($errno, $error, $user, $host) {\n    $this->throwCommonException($errno, $error);\n\n    $message = pht(\n      'Attempt to connect to %s@%s failed with error #%d: %s.',\n      $user,\n      $host,","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/infrastructure/storage/connection/mysql/AphrontBaseMySQLDatabaseConnection.php#L344-L380","documentation":"MySQL returned error 1045 'Access denied for user ...' (using password: YES/NO) during the handshake, which the connection layer translates to AphrontInvalidCredentialsQueryException. Unlike 1044/1142 (authorization of a specific statement), 1045 means the username/password/host combination itself was rejected. The account may also not exist for the host part MySQL resolved.","triggerScenarios":"mysql.user / mysql.pass (or cluster.databases credentials) in the connection configuration are wrong or stale; password contains characters that were mangled by shell or config quoting; the MySQL account exists as 'user'@'localhost' but the client connects over TCP as 'user'@'10.x.x.x' (or vice versa).","commonSituations":"Database password was rotated but Phabricator config was not updated; config copied between environments with different credentials; MySQL 8 default caching_sha2_password rejecting an older client, which surfaces as access denied; user dropped or recreated during maintenance.","solutions":["Prove the credentials outside Phabricator: mysql -h<host> -P<port> -u<user> -p from the same machine Phabricator runs on","Fix the stored credentials, e.g. phabricator/bin/config set mysql.pass 'correct-password' (mind shell quoting of special characters)","If the external test also fails, fix the MySQL account: CREATE USER ... IDENTIFIED BY ... for the exact host pattern the connection uses, or align the host you connect as","For MySQL 8 auth-plugin mismatches, create the user with mysql_native_password or use a client/mysqlnd build that supports caching_sha2_password"],"exampleFix":"# before: stale password after a DB rotation\nphabricator/bin/config get mysql.pass   # old value\n\n# after: update the stored credential, then verify\nphabricator/bin/config set mysql.pass 'new-p4ssw0rd!'\nphabricator/bin/storage probe","handlingStrategy":"validation","validationCode":"// Fail fast at boot: verify the configured credentials before serving traffic.\n$conn = new AphrontMySQLiDatabaseConnection();\n$conn->setConfiguration($config);\ntry {\n  $conn->openConnection();\n} catch (AphrontInvalidCredentialsQueryException $ex) {\n  throw new Exception(pht('Stored database credentials are invalid.'));\n}","typeGuard":null,"tryCatchPattern":"try {\n  $conn = $dao->establishConnection('r');\n} catch (AphrontInvalidCredentialsQueryException $ex) {\n  // Credential/config problem: page the operator; retrying is pointless.\n}","preventionTips":["Keep database credentials in the Phabricator config (mysql.pass / cluster.databases), not in ad-hoc scripts","After rotating the MySQL password, immediately update config and run phabricator/bin/storage probe","Create MySQL accounts with a host pattern matching how the app actually connects (TCP vs localhost)","On MySQL 8, prefer mysql_native_password or a client with caching_sha2_password support to avoid auth-plugin access-denied"],"tags":["mysql","authentication","credentials","configuration"],"backgroundTag":"invalid-database-credentials","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}