nats-io/nats-server · error

publish allow: %w

Error message

publish allow: %w

What it means

Inside validatePermissionSubjects: checkPermSubjectArray rejected one of the publish allow subjects in a Permissions block; this wrapper names the section (publish allow) and propagates the underlying subject validation error.

Source

Thrown at server/auth.go:1735

	}
	for _, u := range o.Nkeys {
		if err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {
			return err
		}
		if err := validatePermissionSubjects(u.Permissions); err != nil {
			return fmt.Errorf("invalid permissions for nkey %q: %w", u.Nkey, err)
		}
	}
	return validateNoAuthUser(o, o.NoAuthUser)
}

func validatePermissionSubjects(p *Permissions) error {
	if p == nil {
		return nil
	}
	if p.Publish != nil {
		if err := checkPermSubjectArray(p.Publish.Allow, false); err != nil {
			return fmt.Errorf("publish allow: %w", err)
		}
		if err := checkPermSubjectArray(p.Publish.Deny, false); err != nil {
			return fmt.Errorf("publish deny: %w", err)
		}
	}
	if p.Subscribe != nil {
		if err := checkPermSubjectArray(p.Subscribe.Allow, true); err != nil {
			return fmt.Errorf("subscribe allow: %w", err)
		}
		if err := checkPermSubjectArray(p.Subscribe.Deny, true); err != nil {
			return fmt.Errorf("subscribe deny: %w", err)
		}
	}
	return nil
}

func validateAllowedConnectionTypes(m map[string]struct{}) error {
	for ct := range m {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Read the wrapped error to find the bad subject
2. Fix or remove the invalid entry in the publish allow list
3. Validate subject strings against NATS subject rules before configuring

When it happens

Trigger: Thrown at server/auth.go:1735 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/60378fda457b59f2. Report an issue: GitHub.