{"record":{"id":"a839978df392ebf9","repo":"nats-io/nats-server","slug":"publish-deny-w","errorCode":null,"errorMessage":"publish deny: %w","messagePattern":"publish deny: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1738,"sourceCode":"\t\t\treturn err\n\t\t}\n\t\tif err := validatePermissionSubjects(u.Permissions); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid permissions for nkey %q: %w\", u.Nkey, err)\n\t\t}\n\t}\n\treturn validateNoAuthUser(o, o.NoAuthUser)\n}\n\nfunc validatePermissionSubjects(p *Permissions) error {\n\tif p == nil {\n\t\treturn nil\n\t}\n\tif p.Publish != nil {\n\t\tif err := checkPermSubjectArray(p.Publish.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"publish allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(p.Publish.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"publish deny: %w\", err)\n\t\t}\n\t}\n\tif p.Subscribe != nil {\n\t\tif err := checkPermSubjectArray(p.Subscribe.Allow, true); err != nil {\n\t\t\treturn fmt.Errorf(\"subscribe allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(p.Subscribe.Deny, true); err != nil {\n\t\t\treturn fmt.Errorf(\"subscribe deny: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateAllowedConnectionTypes(m map[string]struct{}) error {\n\tfor ct := range m {\n\t\tctuc := strings.ToUpper(ct)\n\t\tswitch ctuc {\n\t\tcase jwt.ConnectionTypeStandard, jwt.ConnectionTypeWebsocket,","sourceCodeStart":1720,"sourceCodeEnd":1756,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1720-L1756","documentation":"Validation of a permission's publish deny list failed. This library wraps the underlying subject-array validation error with the 'publish deny' prefix to indicate that the DENY subjects of the Publish permission block are malformed (e.g. invalid wildcard usage or empty subject). It is thrown while validating authorization blocks, users/nkeys permissions, or account-scoped permission structures at server startup or config reload.","triggerScenarios":"Calling validatePermissions (or config validation) with a Permissions struct whose Publish.Deny array contains invalid subjects — e.g. wildcards in illegal positions, tokens exceeding token limits, or subjects with invalid characters. Any []string passed to checkPermSubjectArray(Publish.Deny, false) that fails validation.","commonSituations":"Typos in nats_server.conf authorization block deny: lists, programmatically built Permissions withSubjects like 'foo.>' nested inside another wildcard, or empty-string entries in the deny array. Often surfaces during server startup after editing the authorization section or when generating users via code/tools.","solutions":["Fix the offending subject in the Publish.Deny list — the wrapped error names the exact invalid subject.","Run nats-server --signal reload or start with -V/trace logging to see the wrapped subject detail.","Remove empty strings and duplicate entries from the deny array.","Validate subject syntax rules: tokens separated by '.', wildcards '*' (one token) and '>' (tail only)."],"exampleFix":"// before\nperms := server.Permissions{Publish: {Deny: []string{\"foo.**\", \"\"}}}\n// after\nperms := server.Permissions{Publish: {Deny: []string{\"foo.bar\", \"foo.>\"}}}","handlingStrategy":"validation","validationCode":"for i, s := range perm.Publish.Deny {\n    if s == \"\" || strings.Contains(s, \" \") {\n        return fmt.Errorf(\"invalid publish deny subject at %d: %q\", i, s)\n    }\n}","typeGuard":"func validSubject(s string) bool {\n    if s == \"\" { return false }\n    for i, t := range strings.Split(s, \".\") {\n        if t == \"\" || t == \">\" && i != len(strings.Split(s, \".\"))-1 { return false }\n    }\n    return true\n}","tryCatchPattern":"if err := validatePermissions(perms, true); err != nil {\n    if strings.HasPrefix(err.Error(), \"publish deny\") {\n        log.Fatalf(\"fix Publish.Deny subjects: %v\", err)\n    }\n}","preventionTips":["Lint config with `nats-server -t` before every deploy","Reject empty/whitespace subjects at permission-build time","Use nats.go subject validation helpers when constructing permissions","Cover permission generation with unit tests"],"tags":["config","permissions","validation","nats"],"backgroundTag":"invalid-subject-permission","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}