{"record":{"id":"9c050cb1f90b113a","repo":"nats-io/nats-server","slug":"duplicate-user-q-detected-in-leafnode-authorizati","errorCode":null,"errorMessage":"duplicate user %q detected in leafnode authorization","messagePattern":"duplicate user %q detected in leafnode authorization","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":384,"sourceCode":"}\n\n// Used to validate user names in LeafNode configuration.\n// - rejects mix of single and multiple users.\n// - rejects duplicate user names.\nfunc validateLeafNodeAuthOptions(o *Options) error {\n\tif len(o.LeafNode.Users) == 0 {\n\t\treturn nil\n\t}\n\tif o.LeafNode.Username != _EMPTY_ {\n\t\treturn fmt.Errorf(\"can not have a single user/pass and a users array\")\n\t}\n\tif o.LeafNode.Nkey != _EMPTY_ {\n\t\treturn fmt.Errorf(\"can not have a single nkey and a users array\")\n\t}\n\tusers := map[string]struct{}{}\n\tfor _, u := range o.LeafNode.Users {\n\t\tif _, exists := users[u.Username]; exists {\n\t\t\treturn fmt.Errorf(\"duplicate user %q detected in leafnode authorization\", u.Username)\n\t\t}\n\t\tusers[u.Username] = struct{}{}\n\t}\n\treturn nil\n}\n\nfunc validateLeafNodeProxyOptions(remote *RemoteLeafOpts) ([]string, error) {\n\tvar warnings []string\n\n\tif remote.Proxy.URL == _EMPTY_ {\n\t\treturn warnings, nil\n\t}\n\n\tproxyURL, err := url.Parse(remote.Proxy.URL)\n\tif err != nil {\n\t\treturn warnings, fmt.Errorf(\"invalid proxy URL: %v\", err)\n\t}\n","sourceCodeStart":366,"sourceCodeEnd":402,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L366-L402","documentation":"Leaf node user names must be unique; validateLeafNodeAuthOptions builds a set of usernames from the Users array and throws this error on the first duplicate. It prevents ambiguous authorization matching for leaf node connections.","triggerScenarios":"Options where two or more entries in o.LeafNode.Users share the same Username, detected while iterating the users map in validateLeafNodeAuthOptions (called from validateLeafNode and parseLeafNodes).","commonSituations":"Merging users arrays from multiple remote blocks in generated configs; copy-paste duplicating a user entry; tooling that appends users without deduplication.","solutions":["Remove or rename the duplicated username in the leafnode users array","Audit generated/merged configs for repeated `user:` entries before deployment","Run `nats-server -t` to catch duplicates before restart"],"exampleFix":"// before\nusers = [ { user: \"leaf\", pass: \"p1\" }, { user: \"leaf\", pass: \"p2\" } ]\n// after\nusers = [ { user: \"leaf-a\", pass: \"p1\" }, { user: \"leaf-b\", pass: \"p2\" } ]","handlingStrategy":"validation","validationCode":"seen := map[string]bool{}\nfor _, u := range cfg.LeafNodes.Users {\n  if seen[u.Username] {\n    return fmt.Errorf(\"duplicate leafnode user %q\", u.Username)\n  }\n  seen[u.Username] = true\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Deduplicate users when generating configs programmatically","Review merged config diffs for repeated usernames","Run `nats-server -t` in CI"],"tags":["leafnode","auth","duplicate-user","config-validation"],"backgroundTag":"duplicate-identifier","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}