{"id":"d1a00be3677bb49d","repo":"mongodb/node-mongodb-native","slug":"the-a-option-cannot-be-used-with-the-b-o","errorCode":null,"errorMessage":"The '${a}' option cannot be used with the '${b}' option","messagePattern":"The '(.+?)' option cannot be used with the '(.+?)' option","errorType":"exception","errorClass":"MongoAPIError","httpStatus":null,"severity":"error","filePath":"src/connection_string.ts","lineNumber":170,"sourceCode":"    throw new MongoParseError('Cannot combine replicaSet option with srvMaxHosts');\n  }\n\n  validateLoadBalancedOptions(hostAddresses, options, true);\n\n  return hostAddresses;\n}\n\n/**\n * Checks if TLS options are valid\n *\n * @param allOptions - All options provided by user or included in default options map\n * @throws MongoAPIError if TLS options are invalid\n */\nfunction checkTLSOptions(allOptions: CaseInsensitiveMap): void {\n  if (!allOptions) return;\n  const check = (a: string, b: string) => {\n    if (allOptions.has(a) && allOptions.has(b)) {\n      throw new MongoAPIError(`The '${a}' option cannot be used with the '${b}' option`);\n    }\n  };\n  check('tlsInsecure', 'tlsAllowInvalidCertificates');\n  check('tlsInsecure', 'tlsAllowInvalidHostnames');\n}\nfunction getBoolean(name: string, value: unknown): boolean {\n  if (typeof value === 'boolean') return value;\n  switch (value) {\n    case 'true':\n      return true;\n    case 'false':\n      return false;\n    default:\n      throw new MongoParseError(`${name} must be either \"true\" or \"false\"`);\n  }\n}\n\nfunction getIntFromOptions(name: string, value: unknown): number {","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/connection_string.ts#L152-L188","documentation":"Thrown by checkTLSOptions() when mutually exclusive TLS options are both present. Specifically, tlsInsecure cannot be combined with tlsAllowInvalidCertificates, and tlsInsecure cannot be combined with tlsAllowInvalidHostnames, because tlsInsecure already implies both. It is a MongoAPIError raised during option processing after options are merged from URI and object.","triggerScenarios":"URI like ...?tlsInsecure=true&tlsAllowInvalidCertificates=false; passing tlsInsecure via the options object while the URI carries tlsAllowInvalidHostnames; a config template that sets tlsInsecure plus a per-env override setting one of the granular flags.","commonSituations":"Hardening TLS and forgetting to remove the broad tlsInsecure flag; merging two config sources (URI + options) that each set a different TLS relaxation; copy-pasting a debug connection string that had tlsInsecure plus a granular override.","solutions":["Remove tlsInsecure and keep only the granular flag you need.","Or remove the granular flags (tlsAllowInvalidCertificates/tlsAllowInvalidHostnames) and keep tlsInsecure.","Audit both the URI and the options object passed to new MongoClient — the conflict can come from either source.","Re-run with only one TLS relaxation strategy to confirm the error clears."],"exampleFix":"// before\nnew MongoClient('mongodb://h/db?tlsInsecure=true&tlsAllowInvalidCertificates=false');\n// after\nnew MongoClient('mongodb://h/db?tlsAllowInvalidCertificates=false');","handlingStrategy":"validation","validationCode":"function assertTlsOptionsOk(opts: Record<string, unknown>): void {\n  if (opts.tlsInsecure && (opts.tlsAllowInvalidCertificates != null || opts.tlsAllowInvalidHostnames != null)) {\n    throw new Error('tlsInsecure cannot be combined with tlsAllowInvalidCertificates/tlsAllowInvalidHostnames');\n  }\n}\nassertTlsOptionsOk(resolvedOptions);","typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoAPIError && /option cannot be used with/.test(e.message)) {\n    throw new Error('Conflicting TLS options in connection config');\n  }\n  throw e;\n}","preventionTips":["Pick one TLS relaxation strategy and document it.","Audit both the URI and the options object for TLS flags.","Remove tlsInsecure before adding granular flags."],"tags":["connection-string","tls","config","security"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}