redis/redis-py · error · DataError

Cannot set 'nopass' and supply 'passwords' or…

Error message

Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'

What it means

Raised by Redis.acl_setuser() when the caller passes both a truthy `nopass=True` and a non-empty `passwords` or `hashed_passwords` argument. These are mutually exclusive in Redis ACL semantics: a user is either password-less (nopass) or authenticates with one or more passwords, never both. The check happens before any command is sent to Redis.

Solutions

1. If the user should authenticate with a password, set nopass=False (default) and supply passwords/hashed_passwords.
2. If the user should be password-less, set nopass=True and remove all passwords/hashed_passwords entries.
3. Build a guard in your config layer: if passwords then nopass must be False.

Example fix

# before
client.acl_setuser('alice', nopass=True, passwords=['+secret'])
# after
client.acl_setuser('alice', nopass=False, passwords=['+secret'])

def safe_acl_setuser(client, username, *, nopass=False, passwords=None, hashed_passwords=None, **kw):
    if nopass and (passwords or hashed_passwords):
        raise ValueError("Cannot combine nopass=True with passwords or hashed_passwords")
    return client.acl_setuser(username, nopass=nopass, passwords=passwords, hashed_passwords=hashed_passwords, **kw)

def is_consistent_nopass(nopass: bool, passwords, hashed_passwords) -> bool:
    return not (nopass and bool(passwords or hashed_passwords))

from redis.exceptions import DataError
try:
    client.acl_setuser('alice', nopass=nopass, passwords=passwords)
except DataError as e:
    if "Cannot set 'nopass'" in str(e):
        # decide policy: drop passwords, or disable nopass
        client.acl_setuser('alice', nopass=False, passwords=passwords)
    else:
        raise

When it happens

Trigger: Calling client.acl_setuser('alice', nopass=True, passwords=['+secret']) or client.acl_setuser('bob', nopass=True, hashed_passwords=['+hash...']).

Common situations: Building an ACL form/config that defaults nopass on but also collects a password field; copy-pasting options from an existing user without reconciling the conflict; toggling nopass during testing while leaving passwords set.

Related errors

• Category " " must be prefixed with "+" or
• Command " " must be prefixed with "+" or
• Hashed password must be prefixed with a "+" to add or a "-"…
• Password must be prefixed with a "+" to add or a "-" to…
• ACL LOG count must be an integer

AI-assisted analysis of redis/redis-py@6a6b581b48 (2026-08-10). Data as JSON: /api/errors/92527c89de1f1e18. Report an issue: GitHub.

Appendix: source

Thrown at redis/commands/core.py:482

        if reset:
            pieces.append(b"reset")

        if reset_keys:
            pieces.append(b"resetkeys")

        if reset_channels:
            pieces.append(b"resetchannels")

        if reset_passwords:
            pieces.append(b"resetpass")

        if enabled:
            pieces.append(b"on")
        else:
            pieces.append(b"off")

        if (passwords or hashed_passwords) and nopass:
            raise DataError(
                "Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'"
            )

        if passwords:
            # as most users will have only one password, allow remove_passwords
            # to be specified as a simple string or a list
            passwords = list_or_args(passwords, [])
            for i, password in enumerate(passwords):
                password = encoder.encode(password)
                if password.startswith(b"+"):
                    pieces.append(b">%s" % password[1:])
                elif password.startswith(b"-"):
                    pieces.append(b"<%s" % password[1:])
                else:
                    raise DataError(
                        f"Password {i} must be prefixed with a "
                        f'"+" to add or a "-" to remove'
                    )

View on GitHub (pinned to 6a6b581b48)