user and password not allowed with file URLs: got %v

Error message

user and password not allowed with file URLs: got %v

What it means

newFileSinkFromURL rejects file:// URLs that carry userinfo. Zap treats file URLs as plain filesystem paths, so a username/password component has no meaning and indicates a mistaken destination string.

Source

Thrown at sink.go:132

		return nil, &errSinkNotFound{u.Scheme}
	}
	return factory(u)
}

// RegisterSink registers a user-supplied factory for all sinks with a
// particular scheme.
//
// All schemes must be ASCII, valid under section 0.1 of RFC 3986
// (https://tools.ietf.org/html/rfc3983#section-3.1), and must not already
// have a factory registered. Zap automatically registers a factory for the
// "file" scheme.
func RegisterSink(scheme string, factory func(*url.URL) (Sink, error)) error {
	return _sinkRegistry.RegisterSink(scheme, factory)
}

func (sr *sinkRegistry) newFileSinkFromURL(u *url.URL) (Sink, error) {
	if u.User != nil {
		return nil, fmt.Errorf("user and password not allowed with file URLs: got %v", u)
	}
	if u.Fragment != "" {
		return nil, fmt.Errorf("fragments not allowed with file URLs: got %v", u)
	}
	if u.RawQuery != "" {
		return nil, fmt.Errorf("query parameters not allowed with file URLs: got %v", u)
	}
	// Error messages are better if we check hostname and port separately.
	if u.Port() != "" {
		return nil, fmt.Errorf("ports not allowed with file URLs: got %v", u)
	}
	if hn := u.Hostname(); hn != "" && hn != "localhost" {
		return nil, fmt.Errorf("file URLs must leave host empty or use localhost: got %v", u)
	}

	return sr.newFileSinkFromPath(u.Path)
}

View on GitHub (pinned to bbd4ecbd87)

Solutions

Remove the user:pass@ component from the file URL: use file:///var/log/app.log.
Use a plain absolute path (/var/log/app.log) instead of a file:// URL.
If you need credentials, you are likely targeting a network sink (e.g. a custom registered scheme), not file://.

Example fix

// before
zap.Open("file://admin:secret@/var/log/app.log")
// after
zap.Open("file:///var/log/app.log")

Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(dest)
if err == nil && u.Scheme == "file" && u.User != nil {
    return fmt.Errorf("file URL must not contain credentials: %s", dest)
}

Try / catch

if _, err := zap.Open(dest); err != nil {
    if strings.Contains(err.Error(), "user and password not allowed") {
        return fmt.Errorf("strip credentials from file URL %q", dest)
    }
    return err
}

Prevention

Never reuse authenticated network URLs as file:// destinations
Strip userinfo from URL values during config sanitization
Store credentials separately from log destination config

When it happens

Trigger: Passing a destination like file://user:pass@/var/log/app.log to zap.Open or Outputs; accidentally reusing an authenticated URL (e.g. an FTP or HTTP URL) with the file scheme.

Common situations: Config templating that swaps the scheme of an authenticated URL to file://; copy-paste from connection strings that include credentials.

Related errors

AI-assisted analysis of uber-go/zap@bbd4ecbd87 (2026-08-31). Data as JSON: /api/errors/d52ecd0cb9de9ad4. Report an issue: GitHub.