{"record":{"id":"c01a154efcf2d019","repo":"cloudflare/cloudflared","slug":"user-authentication-failed","errorCode":null,"errorMessage":"User authentication failed","messagePattern":"User authentication failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"socks/authenticator.go","lineNumber":86,"sourceCode":"\t// Get the password\n\tpassLen := int(header[0])\n\tpass := make([]byte, passLen)\n\tif _, err := io.ReadAtLeast(reader, pass, passLen); err != nil {\n\t\treturn err\n\t}\n\n\t// Verify the password\n\tif a.IsValid(string(user), string(pass)) {\n\t\t_, err := writer.Write([]byte{userAuthVersion, authSuccess})\n\t\treturn err\n\t}\n\n\t// password failed. Write back failure\n\tif _, err := writer.Write([]byte{userAuthVersion, authFailure}); err != nil {\n\t\treturn err\n\t}\n\n\treturn fmt.Errorf(\"User authentication failed\")\n}\n","sourceCodeStart":68,"sourceCodeEnd":88,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/authenticator.go#L68-L88","documentation":"After reading the client's username and password, the authenticator compares them against the configured credentials. On mismatch it writes a userAuthVersion+authFailure reply and returns 'User authentication failed'. This is an intentional credential rejection, not an I/O failure.","triggerScenarios":"Client supplies a username/password pair not present in the server's configured credential set during the 0x02 sub-negotiation.","commonSituations":"Wrong or rotated proxy credentials in client config; environment variables/secrets not injected; user removed from the access list on the server.","solutions":["Verify the client's username/password match the credentials configured on the cloudflared SOCKS server.","Re-sync rotated credentials on both sides.","Check the credential source (env var, config file) is actually populated at runtime.","Retry with correct credentials; the failure reply (byte 0x01) tells the client auth was rejected."],"exampleFix":"// before\nproxyURL, _ := proxy.URL(proxy.Scheme, \"\")\n// after\nproxyURL, _ := proxy.URL(proxy.Scheme, user+\":\"+pass) // supply valid creds","handlingStrategy":"validation","validationCode":"if user == \"\" || pass == \"\" { return errors.New(\"proxy credentials not set\") }","typeGuard":null,"tryCatchPattern":"_, err := proxyDialer.Dial(addr)\nif err != nil && strings.Contains(err.Error(), \"User authentication failed\") {\n    return fmt.Errorf(\"check proxy credentials: %w\", err)\n}","preventionTips":["Keep client and server credentials in sync","Source credentials from secrets manager, not hardcoded values","Re-sync after credential rotation","Fail fast locally if credentials env vars are empty"],"tags":["socks5","authentication","credentials"],"backgroundTag":"authentication-required","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}