{"record":{"id":"93a63784fe45dea5","repo":"nats-io/nats-server","slug":"unknown-connection-type-q","errorCode":null,"errorMessage":"unknown connection type %q","messagePattern":"unknown connection type %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1761,"sourceCode":"\t\t\treturn fmt.Errorf(\"subscribe allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(p.Subscribe.Deny, true); err != nil {\n\t\t\treturn fmt.Errorf(\"subscribe deny: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateAllowedConnectionTypes(m map[string]struct{}) error {\n\tfor ct := range m {\n\t\tctuc := strings.ToUpper(ct)\n\t\tswitch ctuc {\n\t\tcase jwt.ConnectionTypeStandard, jwt.ConnectionTypeWebsocket,\n\t\t\tjwt.ConnectionTypeLeafnode, jwt.ConnectionTypeLeafnodeWS,\n\t\t\tjwt.ConnectionTypeMqtt, jwt.ConnectionTypeMqttWS,\n\t\t\tjwt.ConnectionTypeInProcess:\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unknown connection type %q\", ct)\n\t\t}\n\t\tif ctuc != ct {\n\t\t\tdelete(m, ct)\n\t\t\tm[ctuc] = struct{}{}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateNoAuthUser(o *Options, noAuthUser string) error {\n\tif noAuthUser == _EMPTY_ {\n\t\treturn nil\n\t}\n\tif len(o.TrustedOperators) > 0 {\n\t\treturn fmt.Errorf(\"no_auth_user not compatible with Trusted Operator\")\n\t}\n\n\tif o.Nkeys == nil && o.Users == nil {","sourceCodeStart":1743,"sourceCodeEnd":1779,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1743-L1779","documentation":"A connection_type in the operator's allowed_connection_types map was not recognized after normalization. The library validates each entry against the known jwt connection types (standard, websocket, leafnode, leafnode_ws, mqtt, mqtt_ws, in_process) and rejects unknown ones with this error.","triggerScenarios":"Config or operator JWT validation where validateAllowedConnectionTypes receives a map containing a key that doesn't map to a known jwt.ConnectionType value, e.g. a typo like 'websocket' vs accepted forms, or an entry from an operator JWT created by an unknown/newer tool.","commonSituations":"Typo in connection_types section of operator settings, hand-edited connection types, or an operator JWT generated by a newer NATS tool introducing a type this server version doesn't know (version mismatch).","solutions":["Correct the connection type key to a known value: standard, websocket, leafnode, leafnode_ws, mqtt, mqtt_ws, in_process.","Check the server version — upgrade nats-server if the type comes from a newer tool release.","Remove the unknown entry from allowed_connection_types.","Regenerate the operator JWT with a matching current nsc version."],"exampleFix":"// before\nconnection_types: [\"websocket\", \"grpc\"]\n// after\nconnection_types: [\"websocket\", \"standard\"]","handlingStrategy":"validation","validationCode":"validTypes := map[string]bool{\"standard\":true,\"websocket\":true,\"leafnode\":true,\"leafnode_ws\":true,\"mqtt\":true,\"mqtt_ws\":true,\"in_process\":true}\nfor ct := range connTypes {\n    if !validTypes[ct] { return fmt.Errorf(\"unknown connection type %q\", ct) }\n}","typeGuard":null,"tryCatchPattern":"if err := validateAllowedConnectionTypes(m); err != nil {\n    log.Fatalf(\"fix connection_types in operator settings: %v\", err)\n}","preventionTips":["Only use documented connection type strings","Keep nsc and nats-server versions aligned","Regenerate operator JWTs after server upgrades","Lint operator JWT before applying"],"tags":["config","operator-jwt","connection-types","nats"],"backgroundTag":"invalid-connection-type","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}