{"id":"742a11f707efc6a8","repo":"mongodb/node-mongodb-native","slug":"connection-is-missing-credentials-when-asked-to-re","errorCode":null,"errorMessage":"Connection is missing credentials when asked to reauthenticate","messagePattern":"Connection is missing credentials when asked to reauthenticate","errorType":"exception","errorClass":"MongoMissingCredentialsError","httpStatus":null,"severity":"error","filePath":"src/cmap/connection_pool.ts","lineNumber":530,"sourceCode":"      );\n      conn.destroy();\n    }\n    this.connections.clear();\n    this.emitAndLog(ConnectionPool.CONNECTION_POOL_CLOSED, new ConnectionPoolClosedEvent(this));\n  }\n\n  /**\n   * @internal\n   * Reauthenticate a connection\n   */\n  async reauthenticate(connection: Connection): Promise<void> {\n    const authContext = connection.authContext;\n    if (!authContext) {\n      throw new MongoRuntimeError('No auth context found on connection.');\n    }\n    const credentials = authContext.credentials;\n    if (!credentials) {\n      throw new MongoMissingCredentialsError(\n        'Connection is missing credentials when asked to reauthenticate'\n      );\n    }\n\n    const resolvedCredentials = credentials.resolveAuthMechanism(connection.hello);\n    const provider = this.server.topology.client.s.authProviders.getOrCreateProvider(\n      resolvedCredentials.mechanism,\n      resolvedCredentials.mechanismProperties\n    );\n\n    if (!provider) {\n      throw new MongoMissingCredentialsError(\n        `Reauthenticate failed due to no auth provider for ${credentials.mechanism}`\n      );\n    }\n\n    await provider.reauth(authContext);\n","sourceCodeStart":512,"sourceCodeEnd":548,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/connection_pool.ts#L512-L548","documentation":"Thrown by reauthenticate() when a connection's authContext exists but contains no credentials. Reauthentication needs the original credentials (username/password or mechanism-specific data) to re-run the handshake; their absence means the connection was created without credentials yet is being asked to reauth. Surfaced as MongoMissingCredentialsError. This typically reflects a misconfigured auth setup or an internal state loss.","triggerScenarios":"The server demands reauthentication and the driver calls reauthenticate(connection); authContext is present but authContext.credentials is null/undefined. Happens when a connection was established without credentials (no auth configured) but something still triggered a reauth path, or when credentials were dropped from the context after initial auth. Encountered with expiring mechanisms (AWS/OIDC/Kerberos) on misconfigured clients.","commonSituations":"Connecting without a username/password in the URI while the server expects auth, then hitting a reauth trigger. Mixing auth and no-auth connections in a pool. Driver version where credentials were not retained on the authContext for certain mechanisms. OIDC/AWS token providers that returned no credentials initially.","solutions":["Provide credentials in the connection string or authMechanism properties so every connection carries them: `mongodb://user:pass@host/?authSource=admin`.","For MONGODB-OIDC or MONGODB-AWS, verify the token/credential callback returns valid credentials on the first call, not just on reauth.","Confirm the authMechanism in the URI matches the server's configured mechanism; mismatched mechanisms can yield empty resolved credentials.","Upgrade the driver to a current patch to pick up credentials-retention fixes in the reauth path."],"exampleFix":"// before - no credentials, but server requires auth\nconst client = new MongoClient('mongodb://host:27017');\n\n// after\nconst client = new MongoClient('mongodb://user:pass@host:27017/?authSource=admin');","handlingStrategy":"validation","validationCode":"// Validate credentials are present before constructing the client.\nfunction assertCredentials(uri) {\n  const u = new URL(uri);\n  const hasCreds = u.username && u.password;\n  if (!hasCreds && !/(authMechanism=(GSSAPI|AWS|OIDC|MONGODB-X509))/i.test(uri)) {\n    throw new Error('MongoDB URI is missing credentials but server requires auth');\n  }\n}\nassertCredentials(process.env.MONGODB_URI);","typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (err) {\n  if (err instanceof MongoMissingCredentialsError) {\n    console.error('Credentials missing or invalid; check the connection string auth.');\n  }\n  throw err;\n}","preventionTips":["Always include credentials in the URI (or authMechanism properties) for authenticated deployments.","For OIDC/AWS, ensure the token/credential callback returns valid values on the first call.","Match the authMechanism in the URI to the server's configured mechanism."],"tags":["authentication","credentials","reauth","connection-pool"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}