{"record":{"id":"b19463b73057073e","repo":"cube-js/cube","slug":"both-user-password-and-auth-token-are-set-please","errorCode":null,"errorMessage":"Both user/password and auth token are set. Please remove password or token.","messagePattern":"Both user/password and auth token are set\\. Please remove password or token\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cubejs-prestodb-driver/src/PrestoDriver.ts","lineNumber":101,"sourceCode":"  protected useSelectTestConnection: boolean;\n\n  /**\n   * Class constructor.\n   */\n  public constructor(config: PrestoDriverConfiguration = {}) {\n    super();\n\n    const dataSource =\n      config.dataSource ||\n      assertDataSource('default');\n    const preAggregations = config.preAggregations || false;\n\n    const dbUser = getEnv('dbUser', { dataSource, preAggregations });\n    const dbPassword = getEnv('dbPass', { dataSource, preAggregations });\n    const authToken = getEnv('prestoAuthToken', { dataSource, preAggregations });\n\n    if (authToken && dbPassword) {\n      throw new Error('Both user/password and auth token are set. Please remove password or token.');\n    }\n\n    this.useSelectTestConnection = config.useSelectTestConnection ??\n      getEnv('dbUseSelectTestConnection', { dataSource, preAggregations });\n\n    this.config = {\n      host: getEnv('dbHost', { dataSource, preAggregations }),\n      port: getEnv('dbPort', { dataSource, preAggregations }),\n      catalog:\n        getEnv('prestoCatalog', { dataSource, preAggregations }) ||\n        getEnv('dbCatalog', { dataSource, preAggregations }),\n      schema:\n        getEnv('dbName', { dataSource, preAggregations }) ||\n        getEnv('dbSchema', { dataSource, preAggregations }),\n      user: dbUser,\n      ...(authToken ? { custom_auth: `Bearer ${authToken}` } : {}),\n      ...(dbPassword ? { basic_auth: { user: dbUser, password: dbPassword } } : {}),\n      ssl: this.getSslOptions(dataSource, preAggregations),","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-prestodb-driver/src/PrestoDriver.ts#L83-L119","documentation":"PrestoDriver supports either basic auth (user/password) or token auth, not both. At construction time it reads dbPass and prestoAuthToken env/config; if both are set it throws to avoid ambiguous credentials being sent to Presto.","triggerScenarios":"Instantiating PrestoDriver (or letting Cube build it from env) when CUBEJS_DB_PASS and CUBEJS_PRESTO_AUTH_TOKEN (or config.password + config.authToken) are both present.","commonSituations":"Leftover password env vars after switching to token-based auth; CI environments with both credentials in .env; team config templates containing both auth styles.","solutions":["Remove the password (CUBEJS_DB_PASS / config.password) and keep only the auth token","Or remove the auth token (CUBEJS_PRESTO_AUTH_TOKEN / config.authToken) if you intend user/password auth","Audit .env / deployment secrets so only one auth mechanism is configured"],"exampleFix":"// before (.env)\nCUBEJS_DB_PASS=secret\nCUBEJS_PRESTO_AUTH_TOKEN=eyJhbGci...\n// after (.env)\nCUBEJS_PRESTO_AUTH_TOKEN=eyJhbGci...","handlingStrategy":"validation","validationCode":"if (process.env.CUBEJS_DB_PASS && process.env.CUBEJS_PRESTO_AUTH_TOKEN) {\n  throw new Error('Remove either CUBEJS_DB_PASS or CUBEJS_PRESTO_AUTH_TOKEN before starting');\n}","typeGuard":"const hasExactlyOneAuth = (cfg) => (!!cfg.password !== !!cfg.authToken);","tryCatchPattern":"try {\n  const driver = new PrestoDriver(config);\n} catch (e) {\n  if (String(e.message).includes('Both user/password and auth token')) {\n    delete config.password; // prefer token auth\n  }\n  throw e;\n}","preventionTips":["Keep only one auth mechanism (password or token) in env/config","Audit deployment secrets for leftover credentials after auth migration","Add a startup config lint that rejects both credentials being present"],"tags":["prestodb","configuration","auth","env-vars"],"backgroundTag":"conflicting-auth-config","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}