redis/redis-py · error · DataError

Cannot set 'nopass' and supply 'passwords' or 'hashed_passwo

Error message

Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'

What it means

Raised by acl_setuser() as a DataError when nopass=True is combined with any passwords or hashed_passwords. These are mutually exclusive on the Redis server too: nopass means 'authenticate without a password', so supplying credentials is contradictory. The guard at redis/commands/core.py:481-484 fires before any command is built.

Source

Thrown at redis/commands/core.py:482

        if reset:
            pieces.append(b"reset")

        if reset_keys:
            pieces.append(b"resetkeys")

        if reset_channels:
            pieces.append(b"resetchannels")

        if reset_passwords:
            pieces.append(b"resetpass")

        if enabled:
            pieces.append(b"on")
        else:
            pieces.append(b"off")

        if (passwords or hashed_passwords) and nopass:
            raise DataError(
                "Cannot set 'nopass' and supply 'passwords' or 'hashed_passwords'"
            )

        if passwords:
            # as most users will have only one password, allow remove_passwords
            # to be specified as a simple string or a list
            passwords = list_or_args(passwords, [])
            for i, password in enumerate(passwords):
                password = encoder.encode(password)
                if password.startswith(b"+"):
                    pieces.append(b">%s" % password[1:])
                elif password.startswith(b"-"):
                    pieces.append(b"<%s" % password[1:])
                else:
                    raise DataError(
                        f"Password {i} must be prefixed with a "
                        f'"+" to add or a "-" to remove'
                    )

View on GitHub (pinned to da03cdc7e8)

Solutions

1. Choose one auth mode: pass nopass=True with no passwords/hashed_passwords, or omit nopass and supply passwords.
2. In your config layer, make nopass and passwords mutually exclusive (radio button, not independent flags).
3. If passwords are conditionally supplied, set nopass = not bool(passwords or hashed_passwords).

Example fix

# before
r.acl_setuser('alice', nopass=True, passwords=['+hunter2'])
# after (pick one)
r.acl_setuser('alice', nopass=True)
# or
r.acl_setuser('alice', enabled=True, passwords=['+hunter2'])

if nopass and (passwords or hashed_passwords):
    raise ValueError('nopass is mutually exclusive with passwords/hashed_passwords')
client.acl_setuser(username, nopass=nopass, passwords=passwords, hashed_passwords=hashed_passwords)

def is_consistent_auth(nopass, passwords, hashed_passwords) -> bool:
    return not (nopass and bool(passwords or hashed_passwords))

from redis.exceptions import DataError
try:
    client.acl_setuser(username, nopass=nopass, passwords=passwords)
except DataError:
    # resolve the conflict and retry with one auth mode
    client.acl_setuser(username, nopass=False, passwords=passwords)

When it happens

Trigger: Calling r.acl_setuser(username, nopass=True, passwords=['+secret']) or acl_setuser(username, nopass=True, hashed_passwords=['+hash']). Any truthy passwords/hashed_passwords iterable with nopass=True triggers it.

Common situations: Building an ACL form/config where a 'no password' checkbox is left on while password fields are also populated; defaults that set nopass=True being overridden by caller-supplied passwords; migrating users and forgetting to clear nopass.

Related errors

• Password {i} must be prefixed with a "+" to add or a "-" to
• Hashed password {i} must be prefixed with a "+" to add or a
• Category "{category}" must be prefixed with "+" or "-"
• Command "{cmd}" must be prefixed with "+" or "-"
• genpass optionally accepts a bits argument, between 0 and 40

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/92527c89de1f1e18.json. Report an issue: GitHub.