{"record":{"id":"5f34e62c78d07d08","repo":"apache/cassandra","slug":"sasl-authentication-is-not-supported-in-version-1","errorCode":null,"errorMessage":"SASL Authentication is not supported in version 1 of the protocol","messagePattern":"SASL Authentication is not supported in version 1 of the protocol","errorType":"exception","errorClass":"ProtocolException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/transport/messages/AuthResponse.java","lineNumber":43,"sourceCode":"import org.apache.cassandra.transport.Message;\nimport org.apache.cassandra.transport.ProtocolException;\nimport org.apache.cassandra.transport.ProtocolVersion;\n\nimport io.netty.buffer.ByteBuf;\n\n/**\n * A SASL token message sent from client to server. Some SASL\n * mechanisms and clients may send an initial token before\n * receiving a challenge from the server.\n */\npublic class AuthResponse extends Message.Request\n{\n    public static final Message.Codec<AuthResponse> codec = new Message.Codec<AuthResponse>()\n    {\n        public AuthResponse decode(ByteBuf body, ProtocolVersion version)\n        {\n            if (version == ProtocolVersion.V1)\n                throw new ProtocolException(\"SASL Authentication is not supported in version 1 of the protocol\");\n\n            ByteBuffer b = CBUtil.readValue(body);\n            byte[] token = new byte[b.remaining()];\n            b.get(token);\n            return new AuthResponse(token);\n        }\n\n        public void encode(AuthResponse response, ByteBuf dest, ProtocolVersion version)\n        {\n            CBUtil.writeValue(response.token, dest);\n        }\n\n        public int encodedSize(AuthResponse response, ProtocolVersion version)\n        {\n            return CBUtil.sizeOfValue(response.token);\n        }\n    };\n","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/transport/messages/AuthResponse.java#L25-L61","documentation":"AuthResponse.decode rejects SASL authentication frames on protocol version 1, which predates the AUTHENTICATE/AUTH_RESPONSE mechanism. Sending an AUTH_RESPONSE message while negotiating with ProtocolVersion.V1 throws this ProtocolException.","triggerScenarios":"A client forced to (or defaulting to) protocol v1 sends an AUTH_RESPONSE after the server replies AUTHENTICATE (server has an authenticator configured, e.g. PasswordAuthenticator).","commonSituations":"Legacy clients pinned to v1 connecting to clusters with authentication enabled; downgrading protocol version for compatibility testing while auth is still required.","solutions":["Upgrade the client to protocol v2 or later (v3+ recommended).","Temporarily disable the server authenticator (AllowAllAuthenticator) only for legacy v1 testing.","Ensure the negotiated version is not silently falling back to v1; set the version explicitly in the client.","If using SimpleClient, pass a modern ProtocolVersion to the constructor/initializer."],"exampleFix":"// before\nSimpleClient client = new SimpleClient(host, port, ProtocolVersion.V1);\n// after\nSimpleClient client = new SimpleClient(host, port, ProtocolVersion.V4);","handlingStrategy":"validation","validationCode":"if (version == ProtocolVersion.V1 && authenticatorConfigured)\n    throw new IllegalStateException(\"Auth requires protocol v2+; negotiated v1\");","typeGuard":null,"tryCatchPattern":"try { authResponse(); } catch (ProtocolException e) { if (e.getMessage().contains(\"not supported in version 1\")) upgradeProtocolVersion(); }","preventionTips":["Never pin clients to protocol v1 against authenticating clusters","Set an explicit modern protocol version instead of relying on negotiation","Require v3+ minimum in client library configuration"],"tags":["authentication","sasl","protocol-version","native-protocol"],"backgroundTag":"unsupported-operation","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}