{"id":"92527c89de1f1e18","repo":"redis/redis-py","slug":"cannot-set-nopass-and-supply-passwords-or-has","errorCode":null,"errorMessage":"Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'","messagePattern":"Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'","errorType":"validation","errorClass":"DataError","httpStatus":null,"severity":"error","filePath":"redis/commands/core.py","lineNumber":482,"sourceCode":"        if reset:\n            pieces.append(b\"reset\")\n\n        if reset_keys:\n            pieces.append(b\"resetkeys\")\n\n        if reset_channels:\n            pieces.append(b\"resetchannels\")\n\n        if reset_passwords:\n            pieces.append(b\"resetpass\")\n\n        if enabled:\n            pieces.append(b\"on\")\n        else:\n            pieces.append(b\"off\")\n\n        if (passwords or hashed_passwords) and nopass:\n            raise DataError(\n                \"Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'\"\n            )\n\n        if passwords:\n            # as most users will have only one password, allow remove_passwords\n            # to be specified as a simple string or a list\n            passwords = list_or_args(passwords, [])\n            for i, password in enumerate(passwords):\n                password = encoder.encode(password)\n                if password.startswith(b\"+\"):\n                    pieces.append(b\">%s\" % password[1:])\n                elif password.startswith(b\"-\"):\n                    pieces.append(b\"<%s\" % password[1:])\n                else:\n                    raise DataError(\n                        f\"Password {i} must be prefixed with a \"\n                        f'\"+\" to add or a \"-\" to remove'\n                    )","sourceCodeStart":464,"sourceCodeEnd":500,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/commands/core.py#L464-L500","documentation":"Raised by acl_setuser() as a DataError when nopass=True is combined with any passwords or hashed_passwords. These are mutually exclusive on the Redis server too: nopass means 'authenticate without a password', so supplying credentials is contradictory. The guard at redis/commands/core.py:481-484 fires before any command is built.","triggerScenarios":"Calling r.acl_setuser(username, nopass=True, passwords=['+secret']) or acl_setuser(username, nopass=True, hashed_passwords=['+hash']). Any truthy passwords/hashed_passwords iterable with nopass=True triggers it.","commonSituations":"Building an ACL form/config where a 'no password' checkbox is left on while password fields are also populated; defaults that set nopass=True being overridden by caller-supplied passwords; migrating users and forgetting to clear nopass.","solutions":["Choose one auth mode: pass nopass=True with no passwords/hashed_passwords, or omit nopass and supply passwords.","In your config layer, make nopass and passwords mutually exclusive (radio button, not independent flags).","If passwords are conditionally supplied, set nopass = not bool(passwords or hashed_passwords)."],"exampleFix":"# before\nr.acl_setuser('alice', nopass=True, passwords=['+hunter2'])\n# after (pick one)\nr.acl_setuser('alice', nopass=True)\n# or\nr.acl_setuser('alice', enabled=True, passwords=['+hunter2'])","handlingStrategy":"validation","validationCode":"if nopass and (passwords or hashed_passwords):\n    raise ValueError('nopass is mutually exclusive with passwords/hashed_passwords')\nclient.acl_setuser(username, nopass=nopass, passwords=passwords, hashed_passwords=hashed_passwords)","typeGuard":"def is_consistent_auth(nopass, passwords, hashed_passwords) -> bool:\n    return not (nopass and bool(passwords or hashed_passwords))","tryCatchPattern":"from redis.exceptions import DataError\ntry:\n    client.acl_setuser(username, nopass=nopass, passwords=passwords)\nexcept DataError:\n    # resolve the conflict and retry with one auth mode\n    client.acl_setuser(username, nopass=False, passwords=passwords)","preventionTips":["Make nopass and password fields mutually exclusive in the UI/config.","Derive nopass = not bool(passwords or hashed_passwords) when in doubt."],"tags":["acl","validation","setuser","password","conflict"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}