go-sql-driver/mysql · error

this user requires old password authentication. If you still

Error message

this user requires old password authentication. If you still want to use it, please add 'allowOldPasswords=1' to your DSN. See also https://github.com/go-sql-driver/mysql/wiki/old_passwords

What it means

ErrOldPassword is returned at auth.go:285 when the server requests the deprecated `mysql_old_password` plugin (pre-4.1 password hashing) and the DSN does not set allowOldPasswords=1. This plugin is cryptographically weak and removed in modern MySQL, so the driver disables it by default. The wiki link in the message documents the migration.

Source

Thrown at errors.go:25

// You can obtain one at http://mozilla.org/MPL/2.0/.

package mysql

import (
	"errors"
	"fmt"
	"log"
	"os"
)

// Various errors the driver might return. Can change between driver versions.
var (
	ErrInvalidConn       = errors.New("invalid connection")
	ErrMalformPkt        = errors.New("malformed packet")
	ErrNoTLS             = errors.New("TLS requested but server does not support TLS")
	ErrCleartextPassword = errors.New("this user requires clear text authentication. If you still want to use it, please add 'allowCleartextPasswords=1' to your DSN")
	ErrNativePassword    = errors.New("this user requires mysql native password authentication")
	ErrOldPassword       = errors.New("this user requires old password authentication. If you still want to use it, please add 'allowOldPasswords=1' to your DSN. See also https://github.com/go-sql-driver/mysql/wiki/old_passwords")
	ErrUnknownPlugin     = errors.New("this authentication plugin is not supported")
	ErrOldProtocol       = errors.New("MySQL server does not support required protocol 41+")
	ErrPktSync           = errors.New("commands out of sync. You can't run this command now")
	ErrPktSyncMul        = errors.New("commands out of sync. Did you run multiple statements at once?")
	ErrPktTooLarge       = errors.New("packet for query is too large. Try adjusting the `Config.MaxAllowedPacket`")
	ErrBusyBuffer        = errors.New("busy buffer")

	// errBadConnNoWrite is used for connection errors where nothing was sent to the database yet.
	// If this happens first in a function starting a database interaction, it should be replaced by driver.ErrBadConn
	// to trigger a resend. Use mc.markBadConn(err) to do this.
	// See https://github.com/go-sql-driver/mysql/pull/302
	errBadConnNoWrite = errors.New("bad connection")
)

var defaultLogger = Logger(log.New(os.Stderr, "[mysql] ", log.Ldate|log.Ltime))

// Logger is used to log critical error messages.
type Logger interface {

View on GitHub (pinned to c426bd9379)

Solutions

  1. Upgrade the account password to a modern hash: `ALTER USER ... IDENTIFIED WITH caching_sha2_password` or mysql_native_password, and set the password again.
  2. Upgrade the MySQL server to a supported version that no longer offers mysql_old_password.
  3. Only as a last resort, add `allowOldPasswords=1` over an encrypted (TLS) transport, understanding the security risk.

Example fix

// before
dsn := "u:p@tcp(host:3306)/db"
// after (preferred: upgrade the account on the server)
//   ALTER USER 'u'@'%' IDENTIFIED WITH mysql_native_password BY 'p';
// fallback (insecure, only over TLS):
dsn := "u:p@tcp(host:3306)/db?tls=true&allowOldPasswords=1"
Defensive patterns

Strategy: validation

Validate before calling

// Before connecting, check server version and account plugin:
//   SHOW VARIABLES LIKE 'version';
//   SELECT user,host,plugin FROM mysql.user;
// Upgrade accounts off mysql_old_password; do not set allowOldPasswords unless required.

Prevention

When it happens

Trigger: Connecting to a very old MySQL/MariaDB server, or to a user account whose password hash is in the pre-4.1 format, causing the server to advertise mysql_old_password. auth() at auth.go:283 sees the plugin and, since AllowOldPasswords is false by default, returns ErrOldPassword.

Common situations: Legacy production systems on MySQL 4.x/early 5.x; user accounts whose passwords were never upgraded after a server migration; embedded appliances shipping old MySQL forks.

Related errors

AI-assisted analysis of go-sql-driver/mysql@c426bd9379 (2026-08-04). Data as JSON: /data/errors/d60080f525efdc78.json. Report an issue: GitHub.