{"id":"d4d501ba6f272b32","repo":"mongodb/node-mongodb-native","slug":"server-returned-an-invalid-nonce-rnonce","errorCode":null,"errorMessage":"Server returned an invalid nonce: ${rnonce}","messagePattern":"Server returned an invalid nonce: (.+?)","errorType":"exception","errorClass":"MongoRuntimeError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/scram.ts","lineNumber":154,"sourceCode":"    cryptoMethod === 'sha256' ? saslprep(password) : passwordDigest(username, password);\n\n  const payload: Binary = ByteUtils.isUint8Array(response.payload)\n    ? new Binary(response.payload)\n    : response.payload;\n\n  const dict = parsePayload(payload);\n\n  const iterations = parseInt(dict.i, 10);\n  if (iterations && iterations < 4096) {\n    // TODO(NODE-3483)\n    throw new MongoRuntimeError(`Server returned an invalid iteration count ${iterations}`);\n  }\n\n  const salt = dict.s;\n  const rnonce = dict.r;\n  if (rnonce.startsWith('nonce')) {\n    // TODO(NODE-3483)\n    throw new MongoRuntimeError(`Server returned an invalid nonce: ${rnonce}`);\n  }\n\n  // Set up start of proof\n  const withoutProof = `c=biws,r=${rnonce}`;\n  const saltedPassword = await HI(\n    processedPassword,\n    ByteUtils.fromBase64(salt),\n    iterations,\n    cryptoMethod\n  );\n\n  const clientKey = await HMAC(cryptoMethod, saltedPassword, 'Client Key');\n  const serverKey = await HMAC(cryptoMethod, saltedPassword, 'Server Key');\n  const storedKey = await H(cryptoMethod, clientKey);\n  const firstMessageBytes = clientFirstMessageBare(username, nonce);\n  const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, false);\n  const payloadString = ByteUtils.toUTF8(payload.buffer, 0, payload.position, false);\n  const authMessage = [firstMessage, payloadString, withoutProof].join(',');","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/scram.ts#L136-L172","documentation":"Thrown by continueScramConversation() (scram.ts:154) as a MongoRuntimeError when the combined nonce returned by the server (rnonce) starts with the literal string 'nonce'. In a valid SCRAM exchange the server must return the client's nonce with its own suffix prepended; a response literally beginning with 'nonce' indicates a malformed or test/placeholder server response.","triggerScenarios":"Server's saslStart response payload has an 'r=' field whose value literally starts with the characters 'nonce' rather than echoing the client nonce. Seen with broken SCRAM implementations in MongoDB-compatible emulators or hand-crafted test harnesses.","commonSituations":"Connecting to a non-genuine MongoDB service that emits a default/placeholder SCRAM nonce; a malformed interception by a proxy; an internal test double returning canned responses.","solutions":["Connect to a genuine MongoDB deployment (community, enterprise, or Atlas)","If testing against a mock, ensure it echoes the client nonce correctly per RFC 5802","Inspect network path for a misbehaving proxy or MITM"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoRuntimeError && /invalid nonce/i.test(e.message)) {\n    // server returned a malformed SCRAM response; verify it is genuine MongoDB\n  }\n  throw e;\n}","preventionTips":["Use genuine MongoDB deployments","Ensure any proxy/load-balancer passes SCRAM payloads through unchanged","For test doubles, implement RFC 5802 nonce echoing correctly"],"tags":["auth","scram","security","server-config"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}