{"id":"7d2184301eaa6cd3","repo":"mongodb/node-mongodb-native","slug":"password-not-allowed-for-mechanism-mongodb-x509","errorCode":null,"errorMessage":"Password not allowed for mechanism MONGODB-X509","messagePattern":"Password not allowed for mechanism MONGODB-X509","errorType":"validation","errorClass":"MongoAPIError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongo_credentials.ts","lineNumber":270,"sourceCode":"        // TODO(NODE-3485): Replace this with a MongoAuthValidationError\n        throw new MongoAPIError(\n          `Invalid source '${this.source}' for mechanism '${this.mechanism}' specified.`\n        );\n      }\n    }\n\n    if (this.mechanism === AuthMechanism.MONGODB_PLAIN && this.source == null) {\n      // TODO(NODE-3485): Replace this with a MongoAuthValidationError\n      throw new MongoAPIError('PLAIN Authentication Mechanism needs an auth source');\n    }\n\n    if (this.mechanism === AuthMechanism.MONGODB_X509 && this.password != null) {\n      if (this.password === '') {\n        Reflect.set(this, 'password', undefined);\n        return;\n      }\n      // TODO(NODE-3485): Replace this with a MongoAuthValidationError\n      throw new MongoAPIError(`Password not allowed for mechanism MONGODB-X509`);\n    }\n\n    const canonicalization = this.mechanismProperties.CANONICALIZE_HOST_NAME ?? false;\n    if (!Object.values(GSSAPICanonicalizationValue).includes(canonicalization)) {\n      throw new MongoAPIError(`Invalid CANONICALIZE_HOST_NAME value: ${canonicalization}`);\n    }\n  }\n\n  static merge(\n    creds: MongoCredentials | undefined,\n    options: Partial<MongoCredentialsOptions>\n  ): MongoCredentials {\n    return new MongoCredentials({\n      username: options.username ?? creds?.username ?? '',\n      password: options.password ?? creds?.password ?? '',\n      mechanism: options.mechanism ?? creds?.mechanism ?? AuthMechanism.MONGODB_DEFAULT,\n      mechanismProperties: options.mechanismProperties ?? creds?.mechanismProperties ?? {},\n      source: options.source ?? options.db ?? creds?.source ?? 'admin'","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongo_credentials.ts#L252-L288","documentation":"Thrown for MONGODB-X509 when a non-empty password is provided. X509 authenticates via a client certificate presented during TLS, so a password is meaningless and rejected. (An empty-string password is silently coerced to undefined and allowed, to tolerate connection-string builders that inject an empty password.)","triggerScenarios":"In MongoCredentials.validate() when mechanism === MONGODB_X509 and password != null and password !== ''.","commonSituations":"Reusing a SCRAM-style username:password connection string and switching to MONGODB-X509; tooling that auto-populates a placeholder password; URL with a stray ':password' before the '@'.","solutions":["Remove the password from the connection string for X509 auth.","If the password is empty in code, that's tolerated; otherwise delete it.","Ensure the client certificate is supplied via tlsCertificateKeyFile (or tlsFile / X509 env)."],"exampleFix":"// before\n'mongodb://CN=app@host/?authMechanism=MONGODB-X509&authSource=$external&password=secret'\n\n// after\n'mongodb://CN=app@host/?authMechanism=MONGODB-X509&authSource=$external'","handlingStrategy":"validation","validationCode":"function validateX509(mechanism: string, password?: string) {\n  if (mechanism === 'MONGODB-X509' && password && password !== '') {\n    throw new Error('Password not allowed for MONGODB-X509');\n  }\n}","typeGuard":"import { MongoAPIError } from 'mongodb';\nfunction isX509PasswordForbidden(e: unknown): boolean {\n  return e instanceof MongoAPIError && /Password not allowed for mechanism MONGODB-X509/.test(e.message);\n}","tryCatchPattern":null,"preventionTips":["Never include a password when switching to X509.","Provide the client cert via tlsCertificateKeyFile instead."],"tags":["auth","credentials","configuration","x509","tls"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}