{"record":{"id":"ab1ed5bf0f9b93f5","repo":"netbirdio/netbird","slug":"auth-flags-with-pin-with-password-with-us","errorCode":null,"errorMessage":"auth flags (--with-pin, --with-password, --with-user-groups) are not supported for %s protocol","messagePattern":"auth flags \\(--with-pin, --with-password, --with-user-groups\\) are not supported for (.+?) protocol","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/cmd/expose.go","lineNumber":116,"sourceCode":"\treturn uint16(targetPort)\n}\n\nfunc validateExposeFlags(cmd *cobra.Command, portStr string) (uint64, error) {\n\tport, err := strconv.ParseUint(portStr, 10, 32)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"invalid port number: %s\", portStr)\n\t}\n\tif port == 0 || port > 65535 {\n\t\treturn 0, fmt.Errorf(\"invalid port number: must be between 1 and 65535\")\n\t}\n\n\tif !isProtocolValid(exposeProtocol) {\n\t\treturn 0, fmt.Errorf(\"unsupported protocol %q: must be http, https, tcp, udp, or tls\", exposeProtocol)\n\t}\n\n\tif isClusterProtocol(exposeProtocol) {\n\t\tif exposePin != \"\" || exposePassword != \"\" || len(exposeUserGroups) > 0 {\n\t\t\treturn 0, fmt.Errorf(\"auth flags (--with-pin, --with-password, --with-user-groups) are not supported for %s protocol\", exposeProtocol)\n\t\t}\n\t} else if cmd.Flags().Changed(\"with-external-port\") {\n\t\treturn 0, fmt.Errorf(\"--with-external-port is not supported for %s protocol\", exposeProtocol)\n\t}\n\n\tif exposePin != \"\" && !pinRegexp.MatchString(exposePin) {\n\t\treturn 0, fmt.Errorf(\"invalid pin: must be exactly 6 digits\")\n\t}\n\n\tif cmd.Flags().Changed(\"with-password\") && exposePassword == \"\" {\n\t\treturn 0, fmt.Errorf(\"password cannot be empty\")\n\t}\n\n\tif cmd.Flags().Changed(\"with-user-groups\") && len(exposeUserGroups) == 0 {\n\t\treturn 0, fmt.Errorf(\"user groups cannot be empty\")\n\t}\n\n\treturn port, nil","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/expose.go#L98-L134","documentation":"HTTP-layer authentication flags (--with-pin, --with-password, --with-user-groups) were combined with a 'cluster' L4 protocol. isClusterProtocol returns true for tcp, udp, and tls, which forward raw byte streams through the proxy cluster, so there is no HTTP request layer in the proxy where a PIN, password, or SSO group check could run. validateExposeFlags rejects the combination up front.","triggerScenarios":"`netbird expose --protocol tcp --with-password secret 5432`, or the same combination with --with-pin or --with-user-groups for tcp, udp, or tls.","commonSituations":"Copy-pasting an HTTP example and only changing --protocol; assuming the PIN/password protects every protocol; wanting 'some auth' on a database port.","solutions":["Drop the auth flags for L4 protocols: `netbird expose --protocol tcp 5432`","If authentication is a hard requirement, either switch to --protocol http/https (the service itself must be HTTP) or enforce authentication inside the exposed application"],"exampleFix":"# before\nnetbird expose --protocol tcp --with-password s3cret 5432\n\n# after\nnetbird expose --protocol tcp 5432","handlingStrategy":"validation","validationCode":"cluster := map[string]bool{\"tcp\": true, \"udp\": true, \"tls\": true}\nhasAuth := pin != \"\" || password != \"\" || len(userGroups) > 0\nif cluster[strings.ToLower(proto)] && hasAuth {\n\tlog.Fatal(\"auth flags only apply to http/https; remove --with-pin/--with-password/--with-user-groups for tcp/udp/tls\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Learn the split: http/https can carry PIN/password/group auth; tcp/udp/tls cannot","When converting an HTTP example to tcp, delete the auth flags along with the protocol change","Enforce authentication in the application itself for L4 exposures"],"tags":["cli","validation","flag-combination","protocol","netbird-cli"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}