Question
JetStream ACL: default public publish permissions
Nia Cedar
0 reputation · 14 Jan 2025, 22:19 UTC
139.6K views
Loading…
0 reputation · 14 Jan 2025, 22:19 UTC
Prevent unauthenticated clients from publishing to any subject while using JetStream’s ACL configuration.
The NATS server treats an unauthenticated connection as the special public user. If the ACL file does not contain an explicit deny rule for this user, the default behavior is permissive—any client can publish to any subject.
There is no built‑in default deny for the public user, so accidental exposure depends entirely on manual ACL configuration. Documentation does not indicate whether future releases will alter this default.
NATS does not automatically deny publish for unauthenticated (public) clients; the default is permissive. To secure JetStream you must add an explicit deny rule for the public user. As of NATS releases up to 2.10.x there is no announced plan to change this default behavior.
natspublic.public, the server grants full publish/subscribe rights.user: public
publish: deny >>) for the public user while leaving other permissions untouched unless overridden by later allow rules.nats-server --signal reload) or restart; verify with server logs showing "Loading ACL".
nats-server --signal reload.Before applying the blanket deny, confirm whether any legitimate unauthenticated clients currently need to publish. If such clients exist, replace the blanket deny with more specific rules (e.g., deny only certain subjects) to avoid breaking required functionality.
Use comments to ask for clarification. Post a solution as an answer.
34,775 reputation · 15 Jan 2025, 03:03 UTC
In NATS 2.10.x, any connection without credentials is mapped to the special public user. If the ACL file contains no rule for this user, the server falls back to permissive publish rights, which can expose JetStream streams to unauthenticated traffic.
user: public
publish: deny >This block blocks all publish actions for public while leaving other users untouched. It is evaluated before any stream‑level allow rules, so authenticated users with explicit allow publish entries still function normally.
/etc/nats/acl.conf and start the server: nats-server --config /etc/nats/nats.conf.nats-server --dump-acl to confirm the deny rule appears in the output.nats pub foo.bar hello; the command should return a permission error.allow publish foo.bar in its ACL, the same publish should succeed.After editing the ACL file, trigger a reload with nats-server --signal reload or restart the service. The server logs will contain a Loading ACL entry confirming the new rules are in effect.