nats-io/nats-server · error

generated invalid subject

Error message

generated invalid subject

What it means

After substituting template values into the permission subject, the result failed IsValidSubject; with failOnBadSubject set (server-side validation) the malformed subject is rejected rather than emitted as an unusable permission.

Source

Thrown at server/auth.go:596

					} else if failOnBadSubject {
						return nil, fmt.Errorf("generated invalid subject %q: %q is not defined", list[i], match[1])
					} else {
						// generate an invalid subject?
						values[tokenNum] = []string{" "}
					}
				} else {
					return nil, fmt.Errorf("template operation in %q: %q is not defined", list[i], op)
				}
			}
			if !hasTags {
				subj := list[i]
				for idx, m := range srcs {
					subj = strings.Replace(subj, m, values[idx][0], -1)
				}
				if IsValidSubject(subj) {
					emittedList = append(emittedList, subj)
				} else if failOnBadSubject {
					return nil, fmt.Errorf("generated invalid subject")
				}
			} else {
				expCount := 1
				for _, v := range values {
					if len(v) == 0 {
						expCount = 0
						break
					}
					if expCount > maxPermTemplateSubjectExpansions/len(v) {
						return nil, fmt.Errorf("%w: %d", errPermTemplateExpansionLimit, maxPermTemplateSubjectExpansions)
					}
					expCount *= len(v)
				}
				if len(emittedList) > maxPermTemplateSubjectExpansions-expCount {
					return nil, fmt.Errorf("%w: %d", errPermTemplateExpansionLimit, maxPermTemplateSubjectExpansions)
				}
				a := nArrayCartesianProduct(values...)
				for _, aa := range a {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Fix the subject template so all substitutions yield valid NATS subjects
2. Ensure tag values do not contain characters illegal in subjects (spaces, dots misplacement, wildcards in wrong position)
3. Validate the expanded subject strings before applying the permissions

When it happens

Trigger: Thrown at server/auth.go:596 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/68079e21e642bf05. Report an issue: GitHub.