{"record":{"id":"a88fc2e2788a7e6b","repo":"nats-io/nats-server","slug":"invalid-permissions-for-user-q-w","errorCode":null,"errorMessage":"invalid permissions for user %q: %w","messagePattern":"invalid permissions for user %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1715,"sourceCode":"\t\tspass := stringToBytes(serverPassword)\n\t\tcpass := stringToBytes(clientPassword)\n\t\tif subtle.ConstantTimeCompare(spass, cpass) == 0 {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true\n}\n\nfunc validateAuth(o *Options) error {\n\tif err := validatePinnedCerts(o.TLSPinnedCerts); err != nil {\n\t\treturn err\n\t}\n\tfor _, u := range o.Users {\n\t\tif err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := validatePermissionSubjects(u.Permissions); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid permissions for user %q: %w\", u.Username, err)\n\t\t}\n\t}\n\tfor _, u := range o.Nkeys {\n\t\tif err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := validatePermissionSubjects(u.Permissions); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid permissions for nkey %q: %w\", u.Nkey, err)\n\t\t}\n\t}\n\treturn validateNoAuthUser(o, o.NoAuthUser)\n}\n\nfunc validatePermissionSubjects(p *Permissions) error {\n\tif p == nil {\n\t\treturn nil\n\t}\n\tif p.Publish != nil {","sourceCodeStart":1697,"sourceCodeEnd":1733,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1697-L1733","documentation":"Startup options validation: validatePermissionSubjects rejected the Permissions block (publish/subscribe allow/deny subject lists) for the named user in o.Users; the wrapped error identifies the exact subject problem.","triggerScenarios":"Thrown at server/auth.go:1715 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped error for the offending subject","Fix invalid subject syntax in the user's permissions section of the config","Ensure subjects do not mix invalid wildcards or empty tokens"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}