{"record":{"id":"ecf674f4fa11fbfc","repo":"grpc/grpc-go","slug":"server-side-auth-info-is-not-of-type-alts-authinfo","errorCode":null,"errorMessage":"server-side auth info is not of type alts.AuthInfo","messagePattern":"server-side auth info is not of type alts\\.AuthInfo","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/alts/alts.go","lineNumber":248,"sourceCode":"\tdefer cancel()\n\topts := handshaker.DefaultServerHandshakerOptions()\n\topts.RPCVersions = &altspb.RpcProtocolVersions{\n\t\tMaxRpcVersion: maxRPCVersion,\n\t\tMinRpcVersion: minRPCVersion,\n\t}\n\tshs, err := handshaker.NewServerHandshaker(ctx, hsConn, rawConn, opts)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tsecConn, authInfo, err := shs.ServerHandshake(ctx)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\t// Close the handshaker since we have obtained a connection.\n\tdefer shs.Close()\n\taltsAuthInfo, ok := authInfo.(AuthInfo)\n\tif !ok {\n\t\treturn nil, nil, errors.New(\"server-side auth info is not of type alts.AuthInfo\")\n\t}\n\tmatch, _ := checkRPCVersions(opts.RPCVersions, altsAuthInfo.PeerRPCVersions())\n\tif !match {\n\t\treturn nil, nil, fmt.Errorf(\"client-side RPC versions is not compatible with this server, local versions: %v, peer versions: %v\", opts.RPCVersions, altsAuthInfo.PeerRPCVersions())\n\t}\n\treturn secConn, authInfo, nil\n}\n\nfunc (g *altsTC) Info() credentials.ProtocolInfo {\n\treturn *g.info\n}\n\nfunc (g *altsTC) Clone() credentials.TransportCredentials {\n\tinfo := *g.info\n\tvar accounts []string\n\tif g.accounts != nil {\n\t\taccounts = make([]string, len(g.accounts))\n\t\tcopy(accounts, g.accounts)","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/credentials/alts/alts.go#L230-L266","documentation":"Returned at credentials/alts/alts.go:246-249 (the server-side analogue of error 14) when shs.ServerHandshake succeeds but the AuthInfo it returns fails the `authInfo.(AuthInfo)` type assertion. The server-side ALTS handshake produced an AuthInfo that is not the expected alts.AuthInfo type.","triggerScenarios":"Server-side altsTC.ServerHandshake finishes the handshaker exchange, but the returned AuthInfo does not implement alts.AuthInfo. Same root causes as the client side: handshaker/proto module skew or a tampered rawConn/AuthInfo path.","commonSituations":"Version mismatch between the server's grpc/alts modules and the ALTS handshaker; outdated vendored alts; a proxy/in-process wrapper that replaces AuthInfo on the server transport.","solutions":["Upgrade the grpc + alts + handshaker module set together and run go mod tidy.","Make sure no middleware rewraps the net.Conn/AuthInfo returned by ServerHandshake before gRPC reads it.","Confirm you are on GCP using the real handshaker service (vmOnGCP true).","Add an integration test on GCP that asserts AuthInfoFromContext(ctx) returns non-nil alts.AuthInfo."],"exampleFix":"// before — server registers ALTS but a Conn wrapper swaps AuthInfo\ncreds := alts.NewServerCreds(opts)\nsrv := grpc.NewServer(grpc.Creds(creds))\n// a transport interceptor replaced AuthInfo -> 'server-side auth info is not of type alts.AuthInfo'\n\n// after — pass rawConn/AuthInfo through unmodified\ncreds := alts.NewServerCreds(opts)\nsrv := grpc.NewServer(grpc.Creds(creds))","handlingStrategy":"type-guard","validationCode":"// Server-side: confirm ALTS creds are registered before relying on ALTS AuthInfo\nsrv := grpc.NewServer(grpc.Creds(alts.NewServerCreds(alts.DefaultServerOptions())))","typeGuard":"func isALTSAuthInfo(ai credentials.AuthInfo) bool {\n    _, ok := ai.(alts.AuthInfo)\n    return ok\n}","tryCatchPattern":"ai, err := alts.AuthInfoFromContext(ctx)\nif err != nil {\n    // likely non-ALTS transport or module skew; check creds + module versions\n}","preventionTips":["Keep grpc + alts + handshaker module versions aligned.","Don't let middleware swap the server transport's AuthInfo.","Run ALTS integration tests on GCP."],"tags":["alts","security","server","grpc-go"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}