{"record":{"id":"5fbac385e8d3a0d2","repo":"nats-io/nats-server","slug":"empty-user-name-not-allowed","errorCode":null,"errorMessage":"empty user name not allowed","messagePattern":"empty user name not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/mqtt.go","lineNumber":240,"sourceCode":")\n\nvar (\n\terrMQTTNotWebsocketPort           = errors.New(\"MQTT clients over websocket must connect to the Websocket port, not the MQTT port\")\n\terrMQTTTopicFilterCannotBeEmpty   = errors.New(\"topic filter cannot be empty\")\n\terrMQTTMalformedVarInt            = errors.New(\"malformed variable int\")\n\terrMQTTSecondConnectPacket        = errors.New(\"received a second CONNECT packet\")\n\terrMQTTServerNameMustBeSet        = errors.New(\"mqtt requires server name to be explicitly set\")\n\terrMQTTUserMixWithUsersNKeys      = errors.New(\"mqtt authentication username not compatible with presence of users/nkeys\")\n\terrMQTTTokenMixWIthUsersNKeys     = errors.New(\"mqtt authentication token not compatible with presence of users/nkeys\")\n\terrMQTTAckWaitMustBePositive      = errors.New(\"ack wait must be a positive value\")\n\terrMQTTJSAPITimeoutMustBePositive = errors.New(\"JS API timeout must be a positive value\")\n\terrMQTTStandaloneNeedsJetStream   = errors.New(\"mqtt requires JetStream to be enabled if running in standalone mode\")\n\terrMQTTConnFlagReserved           = errors.New(\"connect flags reserved bit not set to 0\")\n\terrMQTTWillAndRetainFlag          = errors.New(\"if Will flag is set to 0, Will Retain flag must be 0 too\")\n\terrMQTTPasswordFlagAndNoUser      = errors.New(\"password flag set but username flag is not\")\n\terrMQTTCIDEmptyNeedsCleanFlag     = errors.New(\"when client ID is empty, clean session flag must be set to 1\")\n\terrMQTTEmptyWillTopic             = errors.New(\"empty Will topic not allowed\")\n\terrMQTTEmptyUsername              = errors.New(\"empty user name not allowed\")\n\terrMQTTTopicIsEmpty               = errors.New(\"topic cannot be empty\")\n\terrMQTTPacketIdentifierIsZero     = errors.New(\"packet identifier cannot be 0\")\n\terrMQTTUnsupportedCharacters      = errors.New(\"character not supported for MQTT topics\")\n\terrMQTTInvalidSession             = errors.New(\"invalid MQTT session\")\n\terrMQTTInvalidRetainFlags         = errors.New(\"invalid retained message flags\")\n\terrMQTTInvalidRetainedMessage     = errors.New(\"invalid retained message\")\n\terrMQTTSessionCollision           = errors.New(\"stored session does not match client ID\")\n\terrMQTTInvalidPublishLength       = errors.New(\"invalid publish message, variable header exceeds remaining length\")\n\terrMQTTAckPipelineStopped         = errors.New(\"QoS1 PUBACK pipeline has shut down while admitting a message, \" +\n\t\t\"abandoning the wait for its JetStream ack; failing the connection, \" +\n\t\t\"the client will re-send unacknowledged PUBLISH packets on reconnect\")\n)\n\ntype srvMQTT struct {\n\tlistener     net.Listener\n\tlistenerErr  error\n\tauthOverride bool\n\tsessmgr      mqttSessionManager","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/mqtt.go#L222-L258","documentation":"When the CONNECT packet's username flag is set, the username string must be non-empty; NATS rejects empty usernames with return code BadUserOrPassword (server/mqtt.go:3949). This is a parse/auth-stage rejection after the username has been decoded and stored in c.opts.Username.","triggerScenarios":"A CONNECT packet with mqttConnFlagUsernameFlag set but a zero-length username string (test case: ...,0,0 for the username field), so c.opts.Username equals _EMPTY_.","commonSituations":"Client configs with username:\"\" while the library still sets the username flag, environment-driven config where the username env var is unset/empty, or hand-encoded packets.","solutions":["Provide a non-empty username on the MQTT client connection options.","If anonymous connection is intended, clear the username flag instead of sending an empty username.","Check that the env/config value feeding the username is actually populated at connect time."],"exampleFix":"// before\nopts.SetUsername(os.Getenv(\"MQTT_USER\")) // may be empty\n// after\nif u := os.Getenv(\"MQTT_USER\"); u != \"\" { opts.SetUsername(u) }","handlingStrategy":"validation","validationCode":"// client side\nif username == \"\" && usernameFlagSet {\n    return fmt.Errorf(\"username flag set but username is empty\")\n}","typeGuard":null,"tryCatchPattern":"// client side: on bad-username-or-password CONNACK mentioning empty username, verify credential env/config and reconnect","preventionTips":["Fail fast at startup if required credentials are empty (e.g. os.Exit on empty MQTT_USER).","Only call SetUsername when the value is non-empty.","Log credential presence (not values) during connection setup."],"tags":["mqtt","protocol","authentication","client-error"],"backgroundTag":"empty-credentials","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}