{"record":{"id":"ae3e0008de655cbc","repo":"AlexxIT/go2rtc","slug":"wrong-login","errorCode":null,"errorMessage":"wrong login","messagePattern":"wrong login","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/mqtt/client.go","lineNumber":39,"sourceCode":"}\n\nfunc (c *Client) Connect(clientID, username, password string) (err error) {\n\tif err = c.conn.SetDeadline(time.Now().Add(Timeout)); err != nil {\n\t\treturn\n\t}\n\n\tmsg := NewConnect(clientID, username, password)\n\tif _, err = c.conn.Write(msg.b); err != nil {\n\t\treturn\n\t}\n\n\tb := make([]byte, 4)\n\tif _, err = io.ReadFull(c.conn, b); err != nil {\n\t\treturn\n\t}\n\n\tif !bytes.Equal(b, []byte{CONNACK, 2, 0, 0}) {\n\t\treturn errors.New(\"wrong login\")\n\t}\n\n\treturn\n}\n\nfunc (c *Client) Subscribe(topic string) (err error) {\n\tif err = c.conn.SetDeadline(time.Now().Add(Timeout)); err != nil {\n\t\treturn\n\t}\n\n\tc.mid++\n\tmsg := NewSubscribe(c.mid, topic, 1)\n\t_, err = c.conn.Write(msg.b)\n\treturn\n}\n\nfunc (c *Client) Publish(topic string, payload []byte) (err error) {\n\tif err = c.conn.SetDeadline(time.Now().Add(Timeout)); err != nil {","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/AlexxIT/go2rtc/blob/c245815e75e2a5fd60b4290f12bfc04e55a984d3/pkg/mqtt/client.go#L21-L57","documentation":"After the MQTT client sends CONNECT, the broker must reply with a CONNACK packet of exactly the 4 bytes {CONNACK, 2, 0, 0}, meaning session-present=0 and return-code=0 (connection accepted). Any other CONNACK payload — typically a non-zero return code like 2/3/4/5 — or a different packet indicates rejected credentials, so Connect fails with \"wrong login\".","triggerScenarios":"Calling mqtt Client.Connect (via Dial) when the broker's CONNACK return code is non-zero: bad username/password, unauthorized clientID, broker not accepting anonymous connections, or the server responding with a non-CONNACK packet.","commonSituations":"Wrong username/password in the MQTT URL or config; broker requires credentials but none supplied; ACL denies the user; broker only allows TLS on the chosen port while the client connected in plaintext; stale credentials after a password rotation.","solutions":["Verify username and password are correct — test them with a CLI client: `mosquitto_pub -h host -u user -P pass -t test -m hi`.","Ensure the URL embeds credentials in the expected form: mqtt://user:pass@host:1883.","Confirm the port/encryption matches the broker (1883 plaintext vs 8883 TLS) — a TLS listener receiving plaintext can yield garbage instead of CONNACK.","Check broker ACL/config: anonymous access disabled while no credentials given, or user not authorized for the clientID."],"exampleFix":"// before\nclient, err := mqtt.Dial(\"tcp\", \"broker:1883\", nil)\n// after: supply credentials\nclient, err := mqtt.Dial(\"tcp\", \"mqtt://user:pass@broker:1883\", nil)","handlingStrategy":"try-catch","validationCode":"// Validate credentials non-empty when broker requires auth\nif brokerRequiresAuth && (username == \"\" || password == \"\") {\n    return errors.New(\"mqtt credentials required\")\n}","typeGuard":null,"tryCatchPattern":"client, err := mqtt.Dial(scheme, url, nil)\nif err != nil {\n    if strings.Contains(err.Error(), \"wrong login\") {\n        return fmt.Errorf(\"mqtt credentials rejected by broker; check username/password/port: %w\", err)\n    }\n    return err\n}","preventionTips":["Test credentials with mosquitto_pub before wiring them into the app","Match port to encryption: 1883 plaintext vs 8883 TLS","Store credentials in env/config, not hardcoded, and rotate consistently with the broker","Check broker ACL rules allow the user and clientID"],"tags":["mqtt","authentication","connack"],"backgroundTag":"authentication-required","analyzedSha":"c245815e75e2a5fd60b4290f12bfc04e55a984d3","analyzedAt":"2026-09-07T11:47:02.965Z","contentChangedAt":"2026-09-07T11:47:02.965Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}