{"record":{"id":"9aec5bc552c1af37","repo":"neo4j/neo4j","slug":"terminated-connection-s-s-as-the-client-fail","errorCode":null,"errorMessage":"Terminated connection '%s' (%s) as the client failed to authenticate within %d ms.","messagePattern":"Terminated connection '(.+?)' \\((.+?)\\) as the client failed to authenticate within (.+?) ms\\.","errorType":"exception","errorClass":"ClientTimeoutException","httpStatus":null,"severity":"warning","filePath":"community/bolt/src/main/java/org/neo4j/bolt/protocol/common/handler/AuthenticationTimeoutHandler.java","lineNumber":93,"sourceCode":"        }\n\n        this.connection.memoryTracker().releaseHeap(AuthenticationTimeoutHandler.SHALLOW_SIZE);\n    }\n\n    protected void authTimerEnded(ChannelHandlerContext ctx) throws Exception {\n        ctx.close();\n\n        if (requestReceived) {\n            throw new BoltConnectionFatality(\n                    format(\n                            \"Terminated connection '%s' (%s) as the server failed to handle an authentication request within %d ms.\",\n                            this.connection.id(), ctx.channel(), timeout.toMillis()),\n                    null);\n        }\n\n        // throw ClientTimeoutException instead of BoltConnectionFatality as we do not consider\n        // client induced errors to be as severe as server caused timeouts\n        throw new ClientTimeoutException(format(\n                \"Terminated connection '%s' (%s) as the client failed to authenticate within %d ms.\",\n                this.connection.id(), ctx.channel(), timeout.toMillis()));\n    }\n\n    public void setRequestReceived(boolean requestReceived) {\n        this.requestReceived = requestReceived;\n    }\n}\n","sourceCodeStart":75,"sourceCodeEnd":102,"githubUrl":"https://github.com/neo4j/neo4j/blob/f213380f812b820a1b312e2ea52cb3d8f1931ccc/community/bolt/src/main/java/org/neo4j/bolt/protocol/common/handler/AuthenticationTimeoutHandler.java#L75-L102","documentation":"Thrown by AuthenticationTimeoutHandler.authTimerEnded when the unauthenticated-connection deadline expires and no request was ever received (requestReceived is false). The server closes the channel and raises ClientTimeoutException — deliberately a client-attributed severity, since the client opened a Bolt connection and never sent HELLO/LOGON within internal.server.bolt.unauth_connection_timeout (default 30s).","triggerScenarios":"A TCP connection is opened to the Bolt port and no HELLO follows for 30s: port scanners and health checks that only connect, load balancer probes, clients stuck before handshake (blocked on DNS/TLS setup), or leaked driver connections that were never authenticated.","commonSituations":"LB/tcp health checks configured against 7687 without sending a Bolt handshake; monitoring probes; firewall middleboxes opening verification connections; clients whose first message blocks (e.g. TLS negotiation mismatch with a non-TLS probe).","solutions":["Point health checks at a real Bolt handshake (drivers' verifyConnectivity) or the HTTP status endpoints instead of bare TCP connects.","If probes must connect, expect this INFO-level timeout in logs and filter it — it is by-design protection, not a fault.","Confirm clients complete HELLO promptly (current driver versions; no TLS/provider mismatch that stalls pre-auth).","As a workaround for slow-to-start clients, raise internal.server.bolt.unauth_connection_timeout — but the default 30s is ample for real drivers."],"exampleFix":"# before: LB does a bare TCP check on bolt port, logs fill with timeouts\nlisten 7687;\n\n# after: check with an actual handshake or use HTTP status\n# e.g. use GET on the server's HTTP endpoint (7474) for liveness instead of a raw TCP open on 7687","handlingStrategy":"validation","validationCode":"// health checks: perform a real handshake instead of a bare TCP connect\ntry (Driver d = GraphDatabase.driver(\"bolt://host:7687\", AuthTokens.none())) { d.verifyConnectivity(); } // or use HTTP status endpoint","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never use raw TCP-connect probes against 7687; use driver verifyConnectivity or the HTTP status route.","Expect and filter these client-timeout log lines when probes are unavoidable.","Keep clients current so HELLO is sent immediately after connect."],"tags":["authentication","timeout","health-check","client"],"backgroundTag":null,"analyzedSha":"f213380f812b820a1b312e2ea52cb3d8f1931ccc","analyzedAt":"2026-08-14T15:32:33.859Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}