{"id":"d60080f525efdc78","repo":"go-sql-driver/mysql","slug":"this-user-requires-old-password-authentication-if","errorCode":null,"errorMessage":"this user requires old password authentication. If you still want to use it, please add 'allowOldPasswords=1' to your DSN. See also https://github.com/go-sql-driver/mysql/wiki/old_passwords","messagePattern":"this user requires old password authentication\\. If you still want to use it, please add 'allowOldPasswords=1' to your DSN\\. See also https://github\\.com/go-sql-driver/mysql/wiki/old_passwords","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"errors.go","lineNumber":25,"sourceCode":"// You can obtain one at http://mozilla.org/MPL/2.0/.\n\npackage mysql\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n)\n\n// Various errors the driver might return. Can change between driver versions.\nvar (\n\tErrInvalidConn       = errors.New(\"invalid connection\")\n\tErrMalformPkt        = errors.New(\"malformed packet\")\n\tErrNoTLS             = errors.New(\"TLS requested but server does not support TLS\")\n\tErrCleartextPassword = errors.New(\"this user requires clear text authentication. If you still want to use it, please add 'allowCleartextPasswords=1' to your DSN\")\n\tErrNativePassword    = errors.New(\"this user requires mysql native password authentication\")\n\tErrOldPassword       = errors.New(\"this user requires old password authentication. If you still want to use it, please add 'allowOldPasswords=1' to your DSN. See also https://github.com/go-sql-driver/mysql/wiki/old_passwords\")\n\tErrUnknownPlugin     = errors.New(\"this authentication plugin is not supported\")\n\tErrOldProtocol       = errors.New(\"MySQL server does not support required protocol 41+\")\n\tErrPktSync           = errors.New(\"commands out of sync. You can't run this command now\")\n\tErrPktSyncMul        = errors.New(\"commands out of sync. Did you run multiple statements at once?\")\n\tErrPktTooLarge       = errors.New(\"packet for query is too large. Try adjusting the `Config.MaxAllowedPacket`\")\n\tErrBusyBuffer        = errors.New(\"busy buffer\")\n\n\t// errBadConnNoWrite is used for connection errors where nothing was sent to the database yet.\n\t// If this happens first in a function starting a database interaction, it should be replaced by driver.ErrBadConn\n\t// to trigger a resend. Use mc.markBadConn(err) to do this.\n\t// See https://github.com/go-sql-driver/mysql/pull/302\n\terrBadConnNoWrite = errors.New(\"bad connection\")\n)\n\nvar defaultLogger = Logger(log.New(os.Stderr, \"[mysql] \", log.Ldate|log.Ltime))\n\n// Logger is used to log critical error messages.\ntype Logger interface {","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/go-sql-driver/mysql/blob/c426bd93799de0f0e094c8f0582872c529d0ed0a/errors.go#L7-L43","documentation":"ErrOldPassword is returned at auth.go:285 when the server requests the deprecated `mysql_old_password` plugin (pre-4.1 password hashing) and the DSN does not set allowOldPasswords=1. This plugin is cryptographically weak and removed in modern MySQL, so the driver disables it by default. The wiki link in the message documents the migration.","triggerScenarios":"Connecting to a very old MySQL/MariaDB server, or to a user account whose password hash is in the pre-4.1 format, causing the server to advertise mysql_old_password. auth() at auth.go:283 sees the plugin and, since AllowOldPasswords is false by default, returns ErrOldPassword.","commonSituations":"Legacy production systems on MySQL 4.x/early 5.x; user accounts whose passwords were never upgraded after a server migration; embedded appliances shipping old MySQL forks.","solutions":["Upgrade the account password to a modern hash: `ALTER USER ... IDENTIFIED WITH caching_sha2_password` or mysql_native_password, and set the password again.","Upgrade the MySQL server to a supported version that no longer offers mysql_old_password.","Only as a last resort, add `allowOldPasswords=1` over an encrypted (TLS) transport, understanding the security risk."],"exampleFix":"// before\ndsn := \"u:p@tcp(host:3306)/db\"\n// after (preferred: upgrade the account on the server)\n//   ALTER USER 'u'@'%' IDENTIFIED WITH mysql_native_password BY 'p';\n// fallback (insecure, only over TLS):\ndsn := \"u:p@tcp(host:3306)/db?tls=true&allowOldPasswords=1\"","handlingStrategy":"validation","validationCode":"// Before connecting, check server version and account plugin:\n//   SHOW VARIABLES LIKE 'version';\n//   SELECT user,host,plugin FROM mysql.user;\n// Upgrade accounts off mysql_old_password; do not set allowOldPasswords unless required.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Upgrade legacy accounts to caching_sha2_password/mysql_native_password.","Run supported MySQL versions.","Treat allowOldPasswords=1 as a security exception requiring sign-off."],"tags":["auth","security","legacy"],"analyzedSha":"c426bd93799de0f0e094c8f0582872c529d0ed0a","analyzedAt":"2026-08-04T21:52:59.219Z","schemaVersion":2}