{"record":{"id":"50216ccb4753b5c6","repo":"AlexxIT/go2rtc","slug":"failed-authentication","errorCode":null,"errorMessage":"failed authentication","messagePattern":"failed authentication","errorType":"exception","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"pkg/rtsp/server.go","lineNumber":16,"sourceCode":"package rtsp\n\nimport (\n\t\"bufio\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net\"\n\t\"net/url\"\n\t\"strconv\"\n\t\"strings\"\n\n\t\"github.com/AlexxIT/go2rtc/pkg/core\"\n\t\"github.com/AlexxIT/go2rtc/pkg/tcp\"\n)\n\nvar FailedAuth = errors.New(\"failed authentication\")\n\nfunc NewServer(conn net.Conn) *Conn {\n\treturn &Conn{\n\t\tConnection: core.Connection{\n\t\t\tID:         core.NewID(),\n\t\t\tFormatName: \"rtsp\",\n\t\t\tProtocol:   \"rtsp+tcp\",\n\t\t\tRemoteAddr: conn.RemoteAddr().String(),\n\t\t},\n\t\tconn:   conn,\n\t\treader: bufio.NewReader(conn),\n\t}\n}\n\nfunc (c *Conn) Auth(username, password string) {\n\tinfo := url.UserPassword(username, password)\n\tc.auth = tcp.NewAuth(info)\n}","sourceCodeStart":1,"sourceCodeEnd":34,"githubUrl":"https://github.com/AlexxIT/go2rtc/blob/c245815e75e2a5fd60b4290f12bfc04e55a984d3/pkg/rtsp/server.go#L1-L34","documentation":"FailedAuth is the sentinel error (errors.New(\"failed authentication\")) returned by an RTSP server-side Conn's Accept() when an incoming client fails authentication: Validate() returned invalid credentials and the request was not the benign first unauthenticated request (ffmpeg-style probe) that should just be retried. Callers detect it with errors.Is(err, rtsp.FailedAuth) to log a warning instead of a hard failure.","triggerScenarios":"A client connects to the go2rtc RTSP server (internal/rtsp listener or NewServer) and sends requests with wrong/missing Authorization headers after the initial empty-credentials probe; c.auth.Validate fails non-empty, the server replies 401 once, and Accept() returns FailedAuth.","commonSituations":"VLC/ffmpeg client configured with wrong or outdated RTSP credentials; user removed/changed the password in go2rtc config but the client caches old credentials; a port scanner or misconfigured client hitting the RTSP port; credential mismatch between stream source config and go2rtc api config.","solutions":["Update the client's RTSP URL credentials to match the username/password configured in go2rtc (streams source rtsp://user:pass@...).","Check go2rtc config for the correct credentials and restart clients after changing them.","Treat FailedAuth specially with errors.Is to log a warning and continue accepting other clients instead of crashing the accept loop.","If clients legitimately need no auth, configure the stream/source to allow unauthenticated access rather than sending wrong credentials."],"exampleFix":"// before\nif err := conn.Accept(); err != nil {\n    log.Error().Err(err).Msg(\"accept failed\")\n    return\n}\n// after\nif err := conn.Accept(); err != nil {\n    if errors.Is(err, rtsp.FailedAuth) {\n        log.Warn().Str(\"remote_addr\", conn.Connection.RemoteAddr).Msg(\"[rtsp] failed authentication\")\n        return\n    }\n    log.Error().Err(err).Msg(\"accept failed\")\n    return\n}","handlingStrategy":"try-catch","validationCode":"// client side: ensure credentials match server config before dialing\nif cfg.RTSPUser == \"\" || cfg.RTSPPass == \"\" {\n    return errors.New(\"rtsp credentials must be configured\")\n}","typeGuard":null,"tryCatchPattern":"if err := conn.Accept(); err != nil {\n    if errors.Is(err, rtsp.FailedAuth) {\n        log.Warn().Str(\"remote_addr\", conn.Connection.RemoteAddr).Msg(\"[rtsp] failed authentication\")\n        return nil // keep server alive\n    }\n    return err\n}","preventionTips":["Always use errors.Is(err, rtsp.FailedAuth) to classify auth failures versus transport errors in the accept loop.","Keep client credentials in sync with go2rtc config; change both together.","Monitor FailedAuth warnings for brute-force or misconfigured clients.","Support the unauthenticated first-probe pattern (empty credentials) your clients may send."],"tags":["rtsp","authentication","server","credentials"],"backgroundTag":"authentication-required","analyzedSha":"c245815e75e2a5fd60b4290f12bfc04e55a984d3","analyzedAt":"2026-09-07T11:47:02.965Z","contentChangedAt":"2026-09-07T11:47:02.965Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}