chkpwd function is not supported in the rdf output format

Error message

chkpwd function is not supported in the rdf output format

What it means

The checkpwd function compares a password hash and only makes sense for authentication queries returning JSON. validateSubGraphForRDF rejects any sub-graph whose source function is checkpwd when outputting RDF.

Source

Thrown at query/outputrdf.go:229

	return buf
}

func validateSubGraphForRDF(sg *SubGraph) error {
	if sg.IsGroupBy() {
		return errors.New("groupby is not supported in rdf output format")
	}
	uidCount := sg.Attr == "uid" && sg.Params.DoCount && sg.IsInternal()
	if uidCount {
		return errors.New("uid count is not supported in the rdf output format")
	}
	if sg.Params.Normalize {
		return errors.New("normalize directive is not supported in the rdf output format")
	}
	if sg.Params.IgnoreReflex {
		return errors.New("ignorereflex directive is not supported in the rdf output format")
	}
	if sg.SrcFunc != nil && sg.SrcFunc.Name == "checkpwd" {
		return errors.New("chkpwd function is not supported in the rdf output format")
	}
	if sg.Params.Facet != nil && !sg.Params.ExpandAll {
		return errors.New("facets are not supported in the rdf output format")
	}
	return nil
}

func quotedNumber(val []byte) []byte {
	const overhead = 2 // opening and closing quotes
	if len(val) > math.MaxInt-overhead {
		// Extremely unlikely, but handle overflow case
		tmpVal := make([]byte, 0)
		tmpVal = append(tmpVal, '"')
		tmpVal = append(tmpVal, val...)
		tmpVal = append(tmpVal, '"')
		return tmpVal
	}
	tmpVal := make([]byte, 0, overhead+len(val))

View on GitHub (pinned to 759e242be6)

Solutions

Use JSON output for authentication queries
Perform password checking in application code (fetch the hash, verify locally)
Separate auth queries from RDF export queries

Example fix

// before (rdf output)
{ q(func: eq(password, checkpwd($pw, $hash))) { uid } }
// after
// run with JSON output, or fetch hash and verify in app code (e.g. bcrypt.CompareHashAndPassword)

Defensive patterns

Strategy: validation

Validate before calling

// Go: never route checkpwd queries to RDF output
if strings.Contains(query, "checkpwd(") {
    return errors.New("checkpwd requires JSON output; do not use for RDF export")
}

Type guard

func usesCheckPwd(dql string) bool {
    return strings.Contains(dql, "checkpwd(")
}

Try / catch

res, err := txn.QueryRDF(ctx, dql)
if err != nil && strings.Contains(err.Error(), "chkpwd function is not supported") {
    return txn.Query(ctx, dql)
}

Prevention

Keep authentication queries on JSON endpoints only
Never run auth queries through generic export pipelines
Verify passwords in application code where possible

When it happens

Trigger: A query like `{ q(func: eq(password, checkpwd(pw, "hash"))) { uid } }` run with RDF output format.

Common situations: Login/auth queries accidentally routed through an RDF-configured endpoint or export tool.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/18f77cb68b5908f7. Report an issue: GitHub.