{"record":{"id":"97a2c867f737d1f7","repo":"nats-io/nats-server","slug":"subscribe-deny-w","errorCode":null,"errorMessage":"subscribe deny: %w","messagePattern":"subscribe deny: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1746,"sourceCode":"\nfunc validatePermissionSubjects(p *Permissions) error {\n\tif p == nil {\n\t\treturn nil\n\t}\n\tif p.Publish != nil {\n\t\tif err := checkPermSubjectArray(p.Publish.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"publish allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(p.Publish.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"publish deny: %w\", err)\n\t\t}\n\t}\n\tif p.Subscribe != nil {\n\t\tif err := checkPermSubjectArray(p.Subscribe.Allow, true); err != nil {\n\t\t\treturn fmt.Errorf(\"subscribe allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(p.Subscribe.Deny, true); err != nil {\n\t\t\treturn fmt.Errorf(\"subscribe deny: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateAllowedConnectionTypes(m map[string]struct{}) error {\n\tfor ct := range m {\n\t\tctuc := strings.ToUpper(ct)\n\t\tswitch ctuc {\n\t\tcase jwt.ConnectionTypeStandard, jwt.ConnectionTypeWebsocket,\n\t\t\tjwt.ConnectionTypeLeafnode, jwt.ConnectionTypeLeafnodeWS,\n\t\t\tjwt.ConnectionTypeMqtt, jwt.ConnectionTypeMqttWS,\n\t\t\tjwt.ConnectionTypeInProcess:\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unknown connection type %q\", ct)\n\t\t}\n\t\tif ctuc != ct {\n\t\t\tdelete(m, ct)","sourceCodeStart":1728,"sourceCodeEnd":1764,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1728-L1764","documentation":"Validation of a permission's subscribe deny list failed. The library wraps checkPermSubjectArray's error with 'subscribe deny' to indicate the DENIED subscribe subjects are invalid. Like the other permission validations, it runs during config validation of authorization blocks, users, or accounts.","triggerScenarios":"Calling validation with a Permissions struct whose Subscribe.Deny array fails subject validation: bad wildcards, invalid characters, or empty subjects passed to checkPermSubjectArray(Subscribe.Deny, true).","commonSituations":"Hand-edited config deny lists (e.g. 'foo.>>' or trailing dot), generated permission sets from internal tooling, or after a config migration. Surfaces at server start or reload with the wrapped cause naming the bad subject.","solutions":["Fix the invalid subject in Subscribe.Deny as identified by the wrapped error.","Validate wildcard placement: '>' must be last token, '*' cannot be part of a token.","Remove empty or malformed entries.","Run `nats-server -t -c config` to lint the configuration."],"exampleFix":"// before\nSubscribe: {Deny: []string{\"foo.>>\"}}\n// after\nSubscribe: {Deny: []string{\"foo.>\"}}","handlingStrategy":"validation","validationCode":"for i, s := range perm.Subscribe.Deny {\n    if s == \"\" || !utf8.ValidString(s) {\n        return fmt.Errorf(\"invalid subscribe deny subject at %d: %q\", i, s)\n    }\n}","typeGuard":"func validSubject(s string) bool {\n    parts := strings.Split(s, \".\")\n    for i, t := range parts {\n        if t == \"\" { return false }\n        if strings.ContainsAny(t, \"*>\") && !(t == \"*\" || (t == \">\" && i == len(parts)-1)) { return false }\n    }\n    return true\n}","tryCatchPattern":"if err := validatePermissions(perms, true); err != nil {\n    if strings.HasPrefix(err.Error(), \"subscribe deny\") {\n        log.Fatalf(\"fix Subscribe.Deny subjects: %v\", err)\n    }\n}","preventionTips":["Lint configs with `nats-server -t` pre-deploy","Sanitize deny lists sourced from external systems","Unit-test deny-list generation code","Keep deny entries minimal to reduce typo surface"],"tags":["config","permissions","validation","nats"],"backgroundTag":"invalid-subject-permission","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}