m1k1o/neko · error
noauth mode does not have password
Error message
noauth mode does not have password
What it means
In noauth mode there are no passwords at all: everyone connects as the single anonymous user. UpdatePassword() is a stub that always returns this error to indicate the concept of a password does not exist in this mode.
Source
Thrown at server/internal/member/noauth/provider.go:62
}
// id is username with token
id := fmt.Sprintf("%s-%s", username, token)
provider.profile.Name = username
return id, provider.profile, nil
}
func (provider *MemberProviderCtx) Insert(username string, password string, profile types.MemberProfile) (string, error) {
return "", errors.New("new user is created on first login in noauth mode")
}
func (provider *MemberProviderCtx) UpdateProfile(id string, profile types.MemberProfile) error {
return nil
}
func (provider *MemberProviderCtx) UpdatePassword(id string, password string) error {
return errors.New("noauth mode does not have password")
}
func (provider *MemberProviderCtx) Select(id string) (types.MemberProfile, error) {
return types.MemberProfile{}, errors.New("cannot select user in noauth mode")
}
func (provider *MemberProviderCtx) SelectAll(limit int, offset int) (map[string]types.MemberProfile, error) {
return map[string]types.MemberProfile{}, nil
}
func (provider *MemberProviderCtx) Delete(id string) error {
return errors.New("cannot delete user in noauth mode")
}
View on GitHub (pinned to b0f01cedea)
Solutions
- Do not expose or call password-change functionality in noauth mode.
- Switch to multiuser (or another provider) if password management is required.
- Hide the password UI when the deployment reports noauth mode.
Example fix
// before
err := memberClient.UpdatePassword(id, newPassword)
// after
if memberProvider == "noauth" {
return errors.New("passwords are not used in noauth mode")
}
err := memberClient.UpdatePassword(id, newPassword) Defensive patterns
Strategy: validation
Validate before calling
if memberProvider == "noauth" {
return errors.New("noauth mode has no passwords")
}
err := memberClient.UpdatePassword(id, newPassword) Type guard
func isNoauthUnsupportedErr(err error) bool {
return err != nil && strings.Contains(err.Error(), "in noauth mode")
} Try / catch
err := memberClient.UpdatePassword(id, newPassword)
if err != nil {
if isNoauthUnsupportedErr(err) {
log.Printf("noauth mode: passwords not applicable: %v", err)
}
return err
} Prevention
- Never offer password UI on noauth deployments.
- Check the provider type before any credential-related API call.
- Remember noauth authenticates everyone as the same anonymous user.
- Switch providers if credential management becomes a requirement.
When it happens
Trigger: Any call to the member UpdatePassword API (password-change endpoint) while the member provider is 'noauth'.
Common situations: A client or admin UI offers a 'change password' form against a noauth deployment; the call always fails because noauth has no credentials to change.
Related errors
- password can only be modified in config while in multiuser m
- new user is created on first login in noauth mode
- cannot select user in noauth mode
- cannot delete user in noauth mode
- new user is created on first login in multiuser mode
AI-assisted analysis of m1k1o/neko@b0f01cedea (2026-09-01).
Data as JSON: /api/errors/2e3765cd8ba73704.
Report an issue: GitHub.