{"record":{"id":"b85da6741e01875e","repo":"cloudflare/cloudflared","slug":"unknown-authentication-type","errorCode":null,"errorMessage":"unknown authentication type","messagePattern":"unknown authentication type","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks/auth_handler.go","lineNumber":63,"sourceCode":"\n// Handle gets the methods from the SOCKS5 client and authenticates with the first supported method\nfunc (h *StandardAuthHandler) Handle(bufConn io.Reader, conn io.Writer) error {\n\tmethods, err := readMethods(bufConn)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed to read auth methods: %v\", err)\n\t}\n\n\t// first supported method is used\n\tfor _, method := range methods {\n\t\tauthenticator := h.authenticators[method]\n\t\tif authenticator != nil {\n\t\t\treturn authenticator.Handle(bufConn, conn)\n\t\t}\n\t}\n\n\t// failed to authenticate. No supported authentication type found\n\tconn.Write([]byte{socks5Version, noAcceptable})\n\treturn fmt.Errorf(\"unknown authentication type\")\n}\n\n// readMethods is used to read the number and type of methods\nfunc readMethods(r io.Reader) ([]byte, error) {\n\theader := []byte{0}\n\tif _, err := r.Read(header); err != nil {\n\t\treturn nil, err\n\t}\n\n\tnumMethods := int(header[0])\n\tmethods := make([]byte, numMethods)\n\t_, err := io.ReadAtLeast(r, methods, numMethods)\n\treturn methods, err\n}\n","sourceCodeStart":45,"sourceCodeEnd":78,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/auth_handler.go#L45-L78","documentation":"After reading the client's offered auth methods, StandardAuthHandler.Handle selects the first method it has an authenticator for. If none of the client's methods is supported, it writes a 0x01 'no acceptable methods' reply and returns this error. It means auth negotiation found no mutually supported method.","triggerScenarios":"The client offers only methods not registered in h.authenticators (e.g. GSSAPI only, while the server supports username/password or no-auth).","commonSituations":"Client configured to require a stronger auth method than the server supports; server started without username/password authenticators configured; misconfigured proxy clients pointing at the wrong credentials scheme.","solutions":["Configure the server with an authenticator for the method the client offers (e.g. UserPassAuthenticator).","Set the client to offer username/password (0x02) or no-auth (0x00) methods the server supports.","Check server bootstrap code that authenticators are registered into StandardAuthHandler.","Inspect the 0x01 reply byte client-side and adjust the offered method list."],"exampleFix":"// before\nauthHandler := socks.NewStandardAuthHandler() // no authenticators registered\n// after\nauthHandler := socks.NewStandardAuthHandler()\nauthHandler.AddAuthenticator(socks.UserPassAuth, socks.NewUserPassAuthenticator(users))","handlingStrategy":"validation","validationCode":"// ensure server advertises methods clients will offer\nauthHandler.AddAuthenticator(socks.NoAuthAuthMethod, authenticator)","typeGuard":null,"tryCatchPattern":"if err := h.authHandler.Handle(bufConn, conn); err != nil {\n    if strings.Contains(err.Error(), \"unknown authentication type\") {\n        logger.Info().Msg(\"client offered no supported auth method\")\n    }\n    return err\n}","preventionTips":["Register authenticators for all methods your clients offer","Standardize clients on no-auth (0x00) or user/pass (0x02)","Verify server bootstrap registers authenticators","Keep client/server auth config in sync"],"tags":["socks5","authentication","negotiation"],"backgroundTag":"authentication-required","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}