{"record":{"id":"92527c89de1f1e18","repo":"redis/redis-py","slug":"cannot-set-nopass-and-supply-passwords-or-has","errorCode":null,"errorMessage":"Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'","messagePattern":"Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'","errorType":"exception","errorClass":"DataError","httpStatus":null,"severity":"error","filePath":"redis/commands/core.py","lineNumber":482,"sourceCode":"        if reset:\n            pieces.append(b\"reset\")\n\n        if reset_keys:\n            pieces.append(b\"resetkeys\")\n\n        if reset_channels:\n            pieces.append(b\"resetchannels\")\n\n        if reset_passwords:\n            pieces.append(b\"resetpass\")\n\n        if enabled:\n            pieces.append(b\"on\")\n        else:\n            pieces.append(b\"off\")\n\n        if (passwords or hashed_passwords) and nopass:\n            raise DataError(\n                \"Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'\"\n            )\n\n        if passwords:\n            # as most users will have only one password, allow remove_passwords\n            # to be specified as a simple string or a list\n            passwords = list_or_args(passwords, [])\n            for i, password in enumerate(passwords):\n                password = encoder.encode(password)\n                if password.startswith(b\"+\"):\n                    pieces.append(b\">%s\" % password[1:])\n                elif password.startswith(b\"-\"):\n                    pieces.append(b\"<%s\" % password[1:])\n                else:\n                    raise DataError(\n                        f\"Password {i} must be prefixed with a \"\n                        f'\"+\" to add or a \"-\" to remove'\n                    )","sourceCodeStart":464,"sourceCodeEnd":500,"githubUrl":"https://github.com/redis/redis-py/blob/6a6b581b48225afa0b76912d1028c6035baee932/redis/commands/core.py#L464-L500","documentation":"Raised by Redis.acl_setuser() when the caller passes both a truthy `nopass=True` and a non-empty `passwords` or `hashed_passwords` argument. These are mutually exclusive in Redis ACL semantics: a user is either password-less (nopass) or authenticates with one or more passwords, never both. The check happens before any command is sent to Redis.","triggerScenarios":"Calling client.acl_setuser('alice', nopass=True, passwords=['+secret']) or client.acl_setuser('bob', nopass=True, hashed_passwords=['+hash...']).","commonSituations":"Building an ACL form/config that defaults nopass on but also collects a password field; copy-pasting options from an existing user without reconciling the conflict; toggling nopass during testing while leaving passwords set.","solutions":["If the user should authenticate with a password, set nopass=False (default) and supply passwords/hashed_passwords.","If the user should be password-less, set nopass=True and remove all passwords/hashed_passwords entries.","Build a guard in your config layer: if passwords then nopass must be False."],"exampleFix":"# before\nclient.acl_setuser('alice', nopass=True, passwords=['+secret'])\n# after\nclient.acl_setuser('alice', nopass=False, passwords=['+secret'])","handlingStrategy":"validation","validationCode":"def safe_acl_setuser(client, username, *, nopass=False, passwords=None, hashed_passwords=None, **kw):\n    if nopass and (passwords or hashed_passwords):\n        raise ValueError(\"Cannot combine nopass=True with passwords or hashed_passwords\")\n    return client.acl_setuser(username, nopass=nopass, passwords=passwords, hashed_passwords=hashed_passwords, **kw)","typeGuard":"def is_consistent_nopass(nopass: bool, passwords, hashed_passwords) -> bool:\n    return not (nopass and bool(passwords or hashed_passwords))","tryCatchPattern":"from redis.exceptions import DataError\ntry:\n    client.acl_setuser('alice', nopass=nopass, passwords=passwords)\nexcept DataError as e:\n    if \"Cannot set 'nopass'\" in str(e):\n        # decide policy: drop passwords, or disable nopass\n        client.acl_setuser('alice', nopass=False, passwords=passwords)\n    else:\n        raise","preventionTips":["Make nopass and passwords mutually exclusive in your ACL config schema.","Validate the combination in your form/config layer before reaching the client.","When toggling nopass during tests, clear password fields explicitly."],"tags":["acl","validation","acl-setuser","input-validation","mutually-exclusive"],"backgroundTag":null,"analyzedSha":"6a6b581b48225afa0b76912d1028c6035baee932","analyzedAt":"2026-08-10T12:52:44.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}