{"record":{"id":"7f9729a6a850b7e4","repo":"nats-io/nats-server","slug":"invalid-connection-types-q","errorCode":null,"errorMessage":"invalid connection types %q","messagePattern":"invalid connection types %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/client.go","lineNumber":6853,"sourceCode":"func convertAllowedConnectionTypes(cts []string) (map[string]struct{}, error) {\n\tvar unknown []string\n\tm := make(map[string]struct{}, len(cts))\n\tfor _, i := range cts {\n\t\ti = strings.ToUpper(i)\n\t\tswitch i {\n\t\tcase jwt.ConnectionTypeStandard, jwt.ConnectionTypeWebsocket,\n\t\t\tjwt.ConnectionTypeLeafnode, jwt.ConnectionTypeLeafnodeWS,\n\t\t\tjwt.ConnectionTypeMqtt, jwt.ConnectionTypeMqttWS,\n\t\t\tjwt.ConnectionTypeInProcess:\n\t\t\tm[i] = struct{}{}\n\t\tdefault:\n\t\t\tunknown = append(unknown, i)\n\t\t}\n\t}\n\tvar err error\n\t// We will still return the map of valid ones.\n\tif len(unknown) != 0 {\n\t\terr = fmt.Errorf(\"invalid connection types %q\", unknown)\n\t}\n\treturn m, err\n}\n\n// This will return true if the connection is of a type present in the given `acts` map.\n// Note that so far this is used only for CLIENT or LEAF connections.\n// But a CLIENT can be standard or websocket (and other types in the future).\nfunc (c *client) connectionTypeAllowed(acts map[string]struct{}) bool {\n\t// Empty means all type of clients are allowed\n\tif len(acts) == 0 {\n\t\treturn true\n\t}\n\tvar want string\n\tswitch c.kind {\n\tcase CLIENT:\n\t\tswitch c.clientType() {\n\t\tcase NATS:\n\t\t\tif c.iproc {","sourceCodeStart":6835,"sourceCodeEnd":6871,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/client.go#L6835-L6871","documentation":"Returned by the accounts/connection-types validation (server/client.go:6853): the map of connection types contains entries the server does not recognize. The function still returns the map of valid types but flags the unknown ones in the error, listing them with %q.","triggerScenarios":"An account config (or JWT) declares a connection_types/connections entry whose value is not a known type (only CLIENT and LEAF are recognized, per the following helper used only for CLIENT/LEAF), e.g. `connection_types: [\"CLIENT\", \"SERVICE\"]`.","commonSituations":"Typos in account JWT or nats-server config connection_types lists, copying config from newer/older server versions that support different type names, operator JWT tooling emitting unsupported values.","solutions":["Remove or correct the unknown connection type in the account JWT / config, keeping only recognized values (CLIENT, LEAF)","Validate the account JWT with `nsc` or the server's account resolver to see which entry is rejected","Check the server version's supported connection types; upgrade the server if the type is legitimately newer"],"exampleFix":"// before (config)\nconnection_types: [\"CLIENT\", \"SERVICE\"]\n// after\nconnection_types: [\"CLIENT\", \"LEAF\"]","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"CLIENT\": true, \"LEAF\": true}\nfor _, t := range cfg.ConnectionTypes {\n    if !allowed[strings.ToUpper(t)] {\n        return fmt.Errorf(\"unknown connection type %q\", t)\n    }\n}","typeGuard":"func isKnownConnType(t string) bool {\n    switch strings.ToUpper(t) {\n    case \"CLIENT\", \"LEAF\":\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Restrict connection_types entries to values supported by your server version","Validate account JWTs with nsc before pushing them to the resolver","Diff configs after server version upgrades for new/renamed type names"],"tags":["config","validation","nats"],"backgroundTag":"invalid-connection-type-config","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}