cloudflare/cloudflared · warning

User authentication failed

Error message

User authentication failed

What it means

After reading the client's username and password, the authenticator compares them against the configured credentials. On mismatch it writes a userAuthVersion+authFailure reply and returns 'User authentication failed'. This is an intentional credential rejection, not an I/O failure.

Source

Thrown at socks/authenticator.go:86

	// Get the password
	passLen := int(header[0])
	pass := make([]byte, passLen)
	if _, err := io.ReadAtLeast(reader, pass, passLen); err != nil {
		return err
	}

	// Verify the password
	if a.IsValid(string(user), string(pass)) {
		_, err := writer.Write([]byte{userAuthVersion, authSuccess})
		return err
	}

	// password failed. Write back failure
	if _, err := writer.Write([]byte{userAuthVersion, authFailure}); err != nil {
		return err
	}

	return fmt.Errorf("User authentication failed")
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Verify the client's username/password match the credentials configured on the cloudflared SOCKS server.
2. Re-sync rotated credentials on both sides.
3. Check the credential source (env var, config file) is actually populated at runtime.
4. Retry with correct credentials; the failure reply (byte 0x01) tells the client auth was rejected.

Example fix

// before
proxyURL, _ := proxy.URL(proxy.Scheme, "")
// after
proxyURL, _ := proxy.URL(proxy.Scheme, user+":"+pass) // supply valid creds

if user == "" || pass == "" { return errors.New("proxy credentials not set") }

_, err := proxyDialer.Dial(addr)
if err != nil && strings.Contains(err.Error(), "User authentication failed") {
    return fmt.Errorf("check proxy credentials: %w", err)
}

When it happens

Trigger: Client supplies a username/password pair not present in the server's configured credential set during the 0x02 sub-negotiation.

Common situations: Wrong or rotated proxy credentials in client config; environment variables/secrets not injected; user removed from the access list on the server.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to read auth methods: %v
• unknown authentication type
• Unsupported auth version: %v
• failed to verify token
• invalid token

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c01a154efcf2d019. Report an issue: GitHub.