{"record":{"id":"7224c286fdd67046","repo":"ekzhang/bore","slug":"server-requires-authentication-but-no-client-secr","errorCode":null,"errorMessage":"server requires authentication, but no client secret was provided","messagePattern":"server requires authentication, but no client secret was provided","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/client.rs","lineNumber":54,"sourceCode":"    pub async fn new(\n        local_host: &str,\n        local_port: u16,\n        to: &str,\n        port: u16,\n        secret: Option<&str>,\n    ) -> Result<Self> {\n        let mut stream = Delimited::new(connect_with_timeout(to, CONTROL_PORT).await?);\n        let auth = secret.map(Authenticator::new);\n        if let Some(auth) = &auth {\n            auth.client_handshake(&mut stream).await?;\n        }\n\n        stream.send(ClientMessage::Hello(port)).await?;\n        let remote_port = match stream.recv_timeout().await? {\n            Some(ServerMessage::Hello(remote_port)) => remote_port,\n            Some(ServerMessage::Error(message)) => bail!(\"server error: {message}\"),\n            Some(ServerMessage::Challenge(_)) => {\n                bail!(\"server requires authentication, but no client secret was provided\");\n            }\n            Some(_) => bail!(\"unexpected initial non-hello message\"),\n            None => bail!(\"unexpected EOF\"),\n        };\n        info!(remote_port, \"connected to server\");\n        info!(\"listening at {to}:{remote_port}\");\n\n        Ok(Client {\n            conn: Some(stream),\n            to: to.to_string(),\n            local_host: local_host.to_string(),\n            local_port,\n            remote_port,\n            auth,\n        })\n    }\n\n    /// Returns the port publicly available on the remote.","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/ekzhang/bore/blob/00a735a89917642df62d84336a90d9476fa175b5/src/client.rs#L36-L72","documentation":"In `Client::new`, the server replied to the client's `Hello` with a `ServerMessage::Challenge`, meaning it requires authentication, but this client was constructed without a secret so it can never answer. The client aborts rather than proceeding unauthenticated.","triggerScenarios":"Connecting to a bore server started with `--secret` while creating the client without a secret (`bore local <port> --to <host>` with no `--secret` flag).","commonSituations":"Server operator enabled a secret but the user was not informed or forgot it; CI scripts or old shell history predating the server's secret; secrets added server-side as a security hardening step.","solutions":["Pass the server's secret to the client: `bore local <port> --to <host> --secret <server-secret>`.","Ask the server operator for the secret if you don't have it.","If auth is not wanted, restart the server without `--secret`."],"exampleFix":"// before\nbore local 3000 --to bore.example.com\n// after\nbore local 3000 --to bore.example.com --secret mysecret","handlingStrategy":"validation","validationCode":"if server_requires_secret && std::env::var(\"BORE_SECRET\").map(|s| s.is_empty()).unwrap_or(true) {\n    bail!(\"BORE_SECRET must be set; the server requires authentication\");\n}","typeGuard":null,"tryCatchPattern":"match Client::new(...).await {\n    Err(e) if e.to_string().contains(\"requires authentication\") => fetch_secret_and_retry(),\n    other => other,\n}","preventionTips":["Store the server secret in an env var (e.g. BORE_SECRET) and always pass it.","Coordinate with the server operator before secrets are enabled.","Add a startup check that fails fast when a known-secret server is targeted without a secret."],"tags":["authentication","network","missing-secret"],"backgroundTag":"authentication-required","analyzedSha":"00a735a89917642df62d84336a90d9476fa175b5","analyzedAt":"2026-09-08T13:27:32.996Z","contentChangedAt":"2026-09-08T13:27:32.996Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}