this user requires mysql native password authentication

Error message

this user requires mysql native password authentication

What it means

ErrNativePassword is returned at auth.go:306 when the server requests the `mysql_native_password` plugin but the DSN has disabled it (AllowNativePasswords == false). Note AllowNativePasswords defaults to TRUE, so this error only appears when a caller explicitly set `allowNativePasswords=false`.

Source

Thrown at errors.go:24

// License, v. 2.0. If a copy of the MPL was not distributed with this file,
// You can obtain one at http://mozilla.org/MPL/2.0/.

package mysql

import (
	"errors"
	"fmt"
	"log"
	"os"
)

// Various errors the driver might return. Can change between driver versions.
var (
	ErrInvalidConn       = errors.New("invalid connection")
	ErrMalformPkt        = errors.New("malformed packet")
	ErrNoTLS             = errors.New("TLS requested but server does not support TLS")
	ErrCleartextPassword = errors.New("this user requires clear text authentication. If you still want to use it, please add 'allowCleartextPasswords=1' to your DSN")
	ErrNativePassword    = errors.New("this user requires mysql native password authentication")
	ErrOldPassword       = errors.New("this user requires old password authentication. If you still want to use it, please add 'allowOldPasswords=1' to your DSN. See also https://github.com/go-sql-driver/mysql/wiki/old_passwords")
	ErrUnknownPlugin     = errors.New("this authentication plugin is not supported")
	ErrOldProtocol       = errors.New("MySQL server does not support required protocol 41+")
	ErrPktSync           = errors.New("commands out of sync. You can't run this command now")
	ErrPktSyncMul        = errors.New("commands out of sync. Did you run multiple statements at once?")
	ErrPktTooLarge       = errors.New("packet for query is too large. Try adjusting the `Config.MaxAllowedPacket`")
	ErrBusyBuffer        = errors.New("busy buffer")

	// errBadConnNoWrite is used for connection errors where nothing was sent to the database yet.
	// If this happens first in a function starting a database interaction, it should be replaced by driver.ErrBadConn
	// to trigger a resend. Use mc.markBadConn(err) to do this.
	// See https://github.com/go-sql-driver/mysql/pull/302
	errBadConnNoWrite = errors.New("bad connection")
)

var defaultLogger = Logger(log.New(os.Stderr, "[mysql] ", log.Ldate|log.Ltime))

// Logger is used to log critical error messages.

View on GitHub (pinned to c426bd9379)

Solutions

Remove `allowNativePasswords=false` from the DSN (default is true) so the driver can use the native plugin.
Or set `allowNativePasswords=true` explicitly.
If you truly require a different plugin, change the account's plugin on the server with ALTER USER.

Example fix

// before
dsn := "u:p@tcp(host:3306)/db?allowNativePasswords=false"
// after
dsn := "u:p@tcp(host:3306)/db"

Defensive patterns

Strategy: validation

Validate before calling

dsn = strings.ReplaceAll(dsn, "allowNativePasswords=false", "")
// rely on the default (true)

Try / catch

if errors.Is(err, mysql.ErrNativePassword) {
    // remove allowNativePasswords=false and retry
}

Prevention

Leave AllowNativePasswords at its default (true).
Only disable it when intentionally forcing a different plugin and the account is updated to match.
Review copied DSN snippets.

When it happens

Trigger: DSN contains `allowNativePasswords=false` AND the MySQL account authenticates with mysql_native_password (the default plugin on MySQL 5.7 and many 8.x setups). The auth switch at auth.go:304 hits the !AllowNativePasswords branch and returns the error.

Common situations: A developer copied `allowNativePasswords=false` from a sample DSN intending to require caching_sha2_password, but the server/user still uses native password; migrating to 8.x default plugin without changing the DSN flag back.

Related errors

AI-assisted analysis of go-sql-driver/mysql@c426bd9379 (2026-08-04). Data as JSON: /data/errors/add5c07c672be97c.json. Report an issue: GitHub.