{"record":{"id":"cf27f0ac6663cc87","repo":"grpc/grpc-go","slug":"clientconn-s-authority-from-transport-creds-q-and","errorCode":null,"errorMessage":"ClientConn's authority from transport creds %q and dial option %q don't match","messagePattern":"ClientConn's authority from transport creds %q and dial option %q don't match","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"clientconn.go","lineNumber":1959,"sourceCode":"func (cc *ClientConn) initAuthority() error {\n\tdopts := cc.dopts\n\t// Historically, we had two options for users to specify the serverName or\n\t// authority for a channel. One was through the transport credentials\n\t// (either in its constructor, or through the OverrideServerName() method).\n\t// The other option (for cases where WithInsecure() dial option was used)\n\t// was to use the WithAuthority() dial option.\n\t//\n\t// A few things have changed since:\n\t// - `insecure` package with an implementation of the `TransportCredentials`\n\t//   interface for the insecure case\n\t// - WithAuthority() dial option support for secure credentials\n\tauthorityFromCreds := \"\"\n\tif creds := dopts.copts.TransportCredentials; creds != nil && creds.Info().ServerName != \"\" {\n\t\tauthorityFromCreds = creds.Info().ServerName\n\t}\n\tauthorityFromDialOption := dopts.authority\n\tif (authorityFromCreds != \"\" && authorityFromDialOption != \"\") && authorityFromCreds != authorityFromDialOption {\n\t\treturn fmt.Errorf(\"ClientConn's authority from transport creds %q and dial option %q don't match\", authorityFromCreds, authorityFromDialOption)\n\t}\n\n\tendpoint := cc.parsedTarget.Endpoint()\n\tif authorityFromDialOption != \"\" {\n\t\tcc.authority = authorityFromDialOption\n\t} else if authorityFromCreds != \"\" {\n\t\tcc.authority = authorityFromCreds\n\t} else if auth, ok := cc.resolverBuilder.(resolver.AuthorityOverrider); ok {\n\t\tcc.authority = auth.OverrideAuthority(cc.parsedTarget)\n\t} else if strings.HasPrefix(endpoint, \":\") {\n\t\tcc.authority = \"localhost\" + encodeAuthority(endpoint)\n\t} else {\n\t\tcc.authority = encodeAuthority(endpoint)\n\t}\n\treturn nil\n}\n","sourceCodeStart":1941,"sourceCodeEnd":1976,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/clientconn.go#L1941-L1976","documentation":"initAuthority (clientconn.go:1953-1959) reads the server name from transport credentials (creds.Info().ServerName) and the value set by the WithAuthority() dial option. If BOTH are non-empty AND they differ, the channel refuses to start because the authority would be ambiguous for TLS SNI and :authority headers.","triggerScenarios":"Combining credentials.NewTLS credsWithServerName(...) (or OverrideServerName) with grpc.WithAuthority(\"...\") where the two strings disagree. NewClient/Dial fails before connecting.","commonSituations":"Setting WithAuthority for a proxy but leaving the TLS creds pointed at the real backend name; refactoring that updated one and not the other; connecting through an LB with a different authority than the cert SAN.","solutions":["Make the WithAuthority() value and the credentials ServerName identical.","If they must differ legitimately, remove one of them — typically drop WithAuthority and rely on the creds' ServerName.","Use OverrideServerName on the credentials so there is a single source of truth."],"exampleFix":"// before\ncreds := credentials.NewTLS(&tls.Config{ServerName: \"a.example\"})\ngrpc.WithTransportCredentials(creds), grpc.WithAuthority(\"b.example\")\n// after\ncreds := credentials.NewTLS(&tls.Config{ServerName: \"a.example\"})\ngrpc.WithTransportCredentials(creds)  // authority derived from creds","handlingStrategy":"validation","validationCode":"// Ensure authority and credential ServerName agree before constructing the channel.\nfunc authoritiesAgree(serverName, authority string) bool {\n    if serverName == \"\" || authority == \"\" { return true }\n    return serverName == authority\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set authority in exactly one place: either credentials ServerName or WithAuthority, not both.","Add a startup assertion that the two match if both are configured.","Document the intended authority source for each connection target."],"tags":["go","grpc","clientconn","tls","authority","config"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}