netbirdio/netbird · warning

password cannot be empty

Error message

password cannot be empty

What it means

--with-password was explicitly present on the command line (cmd.Flags().Changed("with-password") is true) but its value is the empty string. NetBird distinguishes 'flag absent' from 'flag set to empty' and rejects the latter, since an empty password would silently expose the service unprotected.

Source

Thrown at client/cmd/expose.go:127

	if !isProtocolValid(exposeProtocol) {
		return 0, fmt.Errorf("unsupported protocol %q: must be http, https, tcp, udp, or tls", exposeProtocol)
	}

	if isClusterProtocol(exposeProtocol) {
		if exposePin != "" || exposePassword != "" || len(exposeUserGroups) > 0 {
			return 0, fmt.Errorf("auth flags (--with-pin, --with-password, --with-user-groups) are not supported for %s protocol", exposeProtocol)
		}
	} else if cmd.Flags().Changed("with-external-port") {
		return 0, fmt.Errorf("--with-external-port is not supported for %s protocol", exposeProtocol)
	}

	if exposePin != "" && !pinRegexp.MatchString(exposePin) {
		return 0, fmt.Errorf("invalid pin: must be exactly 6 digits")
	}

	if cmd.Flags().Changed("with-password") && exposePassword == "" {
		return 0, fmt.Errorf("password cannot be empty")
	}

	if cmd.Flags().Changed("with-user-groups") && len(exposeUserGroups) == 0 {
		return 0, fmt.Errorf("user groups cannot be empty")
	}

	return port, nil
}

func isProtocolValid(exposeProtocol string) bool {
	switch strings.ToLower(exposeProtocol) {
	case "http", "https", "tcp", "udp", "tls":
		return true
	default:
		return false
	}
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Provide a real password: `--with-password my-secret`
2. Fix the source of the empty value: verify the variable/secret reference (`echo "${SECRET:?SECRET not set}"`) before building the command

Example fix

# before
netbird expose --with-password "$SECRET" 8080   # SECRET unset

# after
export SECRET=my-secret
netbird expose --with-password "$SECRET" 8080

if passwordFlagSet && password == "" {
	log.Fatal("--with-password was set but empty; check the variable feeding it (unset secret?)")
}

When it happens

Trigger: `--with-password=` or `--with-password ""`, most commonly an unset or empty environment variable expanded by a script (e.g. `--with-password "$SECRET"` with SECRET unset).

Common situations: CI pipelines and deployment scripts passing an unset secret variable; templating systems (YAML/JSON env injection) rendering an empty string.

Related errors

• user groups cannot be empty
• invalid port number: %s
• invalid port number: must be between 1 and 65535
• unsupported protocol %q: must be http, https, tcp, udp, or t
• auth flags (--with-pin, --with-password, --with-user-groups)

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/1ff98ee16c5d8a07. Report an issue: GitHub.