mongodb/node-mongodb-native · error · MongoInvalidArgumentError

AuthContext must contain a valid nonce property

Error message

AuthContext must contain a valid nonce property

What it means

Thrown by executeScram() (scram.ts:106) as a MongoInvalidArgumentError when authContext.nonce is falsy at the point of building the SCRAM first message. The nonce is normally generated in prepare(); reaching executeScram without one means the handshake was short-circuited or the AuthContext was constructed incorrectly. This is an internal-state violation rather than a user input error.

Source

Thrown at src/cmap/auth/scram.ts:106

  // Since the username is not sasl-prep-d, we need to do this here.
  return {
    saslStart: 1,
    mechanism,
    payload: new Binary(
      ByteUtils.concat([ByteUtils.fromUTF8('n,,'), clientFirstMessageBare(username, nonce)])
    ),
    autoAuthorize: 1,
    options: { skipEmptyExchange: true }
  };
}

async function executeScram(cryptoMethod: CryptoMethod, authContext: AuthContext): Promise<void> {
  const { connection, credentials } = authContext;
  if (!credentials) {
    throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
  }
  if (!authContext.nonce) {
    throw new MongoInvalidArgumentError('AuthContext must contain a valid nonce property');
  }
  const nonce = authContext.nonce;
  const db = credentials.source;

  const saslStartCmd = makeFirstMessage(cryptoMethod, credentials, nonce);
  const response = await connection.command(ns(`${db}.$cmd`), saslStartCmd, undefined);
  await continueScramConversation(cryptoMethod, response, authContext);
}

async function continueScramConversation(
  cryptoMethod: CryptoMethod,
  response: Document,
  authContext: AuthContext
): Promise<void> {
  const connection = authContext.connection;
  const credentials = authContext.credentials;
  if (!credentials) {
    throw new MongoMissingCredentialsError('AuthContext must provide credentials.');

View on GitHub (pinned to 3366c21a63)

Solutions

1. Avoid bypassing the standard connect/handshake flow - let the driver call prepare() then auth()
2. If you subclass ScramSHA, ensure super.prepare() runs and sets authContext.nonce
3. Report as a driver bug if reached with an unmodified MongoClient - include driver version and repro

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoInvalidArgumentError && /nonce/.test(e.message)) {
    // internal state issue - report to driver maintainers with full repro
  }
  throw e;
}

When it happens

Trigger: Calling executeScram directly (bypassing prepare()); an AuthContext built manually without invoking prepare() first; a defect where prepare() failed to set the nonce after an earlier thrown error was swallowed.

Common situations: Driver bug or monkey-patching the auth provider; using an internal API in a non-standard order; an earlier exception during randomBytes(24) being caught and ignored before nonce assignment.

Related errors

• Unable to continue SCRAM without valid nonce
• Username required for mechanism '${this.mechanism}'
• AuthContext must provide credentials.
• Server returned an invalid iteration count ${iterations}
• Server returned an invalid nonce: ${rnonce}

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/374f56697d72b8cd.json. Report an issue: GitHub.