{"record":{"id":"9ce0f0cb3637cb72","repo":"ekzhang/bore","slug":"expected-authentication-challenge-but-no-secret-w","errorCode":null,"errorMessage":"expected authentication challenge, but no secret was required","messagePattern":"expected authentication challenge, but no secret was required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/auth.rs","lineNumber":73,"sourceCode":"        let challenge = Uuid::new_v4();\n        stream.send(ServerMessage::Challenge(challenge)).await?;\n        match stream.recv_timeout().await? {\n            Some(ClientMessage::Authenticate(tag)) => {\n                ensure!(self.validate(&challenge, &tag), \"invalid secret\");\n                Ok(())\n            }\n            _ => bail!(\"server requires secret, but no secret was provided\"),\n        }\n    }\n\n    /// As the client, answer a challenge to attempt to authenticate with the server.\n    pub async fn client_handshake<T: AsyncRead + AsyncWrite + Unpin>(\n        &self,\n        stream: &mut Delimited<T>,\n    ) -> Result<()> {\n        let challenge = match stream.recv_timeout().await? {\n            Some(ServerMessage::Challenge(challenge)) => challenge,\n            _ => bail!(\"expected authentication challenge, but no secret was required\"),\n        };\n        let tag = self.answer(&challenge);\n        stream.send(ClientMessage::Authenticate(tag)).await?;\n        Ok(())\n    }\n}\n","sourceCodeStart":55,"sourceCodeEnd":80,"githubUrl":"https://github.com/ekzhang/bore/blob/00a735a89917642df62d84336a90d9476fa175b5/src/auth.rs#L55-L80","documentation":"During `Authenticator::client_handshake`, the client expects the server's first message to be a `ServerMessage::Challenge`, but received something else (typically a `Hello`) or nothing. This means the server did not request authentication, yet the client was configured with a secret.","triggerScenarios":"Calling `client_handshake` (i.e. constructing a client with a secret) against a server that was started without `--secret`; the server immediately sends `Hello` instead of a challenge; the connection EOFs or times out before a challenge arrives.","commonSituations":"User passes `--secret` on the client while the server runs without a secret; server upgraded/downgraded to a version without auth support; connecting to the wrong port or a different bore instance than intended.","solutions":["Remove `--secret` from the client command, since the server does not require authentication: `bore local <port> --to <host>`.","If auth is desired, restart the server with the same secret: `bore server --secret mysecret`.","Verify you are connecting to the intended host/port and that both sides run compatible bore versions."],"exampleFix":"// before (server started without --secret)\nbore local 3000 --to bore.example.com --secret mysecret\n// after\nbore local 3000 --to bore.example.com","handlingStrategy":"validation","validationCode":"// Only configure a client secret if the server actually uses auth\nif client_secret.is_some() && !server_uses_secret {\n    bail!(\"server does not require a secret; omit --secret\");\n}","typeGuard":null,"tryCatchPattern":"match Client::new(...).await {\n    Err(e) if e.to_string().contains(\"no secret was required\") => retry_without_secret(),\n    other => other,\n}","preventionTips":["Keep client and server secret configuration in one shared source of truth.","Verify server flags (--secret present or not) before connecting.","Pin matching bore versions on both ends."],"tags":["authentication","network","handshake","config-mismatch"],"backgroundTag":"missing-credentials","analyzedSha":"00a735a89917642df62d84336a90d9476fa175b5","analyzedAt":"2026-09-08T13:27:32.996Z","contentChangedAt":"2026-09-08T13:27:32.996Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}