# Mqtt client's connect behavior when pub/sub to an unauthorized topic

**URL:** <https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183>\
**Category:** General\
**Tags:** docker, mqtt\
**Created:** [25 January 2023 17:07 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183 "2023-01-25T17:07:17Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![arlklauss](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/arlklauss/32/64050_2.png) [@arlklauss](https://discourse.nodered.org/u/arlklauss)\
**Post date:** [25 January 2023 17:07 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/1 "2023-01-25T17:07:17Z")

</div>

Hello all!

We are working on a setup where the mqtt broker (vernemq) authorizes the user/client\_id on publishing/subscribing  
certain topics (using broker's ACL). When the topic does not exist in the ACL or the user/client\_id is not authorized to publish or subscrite the topic, the broker then disconnects the client, and that's the right behavior.

But we are facing a problem when we send a invalid or unauthorized topic to the broker, as it disconnects all  
mqtt in/out nodes using the same connection to the broker. Futher, all mqtt in/out nodes keep trying to connect/send their messages including the one with invalid topic and thus it creates and infinite loop.

Is there anything that can be done to avoid this behavior ?

Thanks all in advance.

node-red version 3.02 running on windows 11  
vernemq v.1.12.6.2 running on docker

- using database authentication/authorization ([Auth using a database - VerneMQ](https://docs.vernemq.com/configuring-vernemq/db-auth))
- using TLS

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [25 January 2023 17:13 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/2 "2023-01-25T17:13:36Z")

</div>

Does Vernemq have a free online public MQTT broker where I can test this? (like hive, eclipse, emqx etc: [online brokers for IoT testing and Prototyping](https://mntolia.com/10-free-public-private-mqtt-brokers-for-testing-prototyping/) OR can you provide an MQTT hostname/client details for testing?

Question: Are you setting up node-red to V3.11 or V5 protocol?

---

<div class="post-metadata">

**Author:** ![arlklauss](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/arlklauss/32/64050_2.png) [@arlklauss](https://discourse.nodered.org/u/arlklauss)\
**Post date:** [25 January 2023 17:19 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/3 "2023-01-25T17:19:05Z")

</div>

Hi Steve

I think you can use any broker that supports authentication/authorization.

We are using v.3.11, but have the same behavior using mqtt v5.

Thank u

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [25 January 2023 17:26 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/4 "2023-01-25T17:26:42Z")

</div>

If you want a separate connection for each mqtt node, which I think is what you are asking for, then I think you will have to create a new server config node for each mqtt node.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [25 January 2023 17:29 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/5 "2023-01-25T17:29:38Z")

</div>

What do you see in NR STDOUT / LOGs when the disconnection occurs? For both V3.1 and V5?

The reason I ask is due to the sqecification and how well a broker adheres. If I remember correctly when working on the MQTT nodes for V5, the correct result in attempting to subscribe to a protected topic is to disconnect with a reason code of 135 or 144 (see [spec](https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901208))

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [25 January 2023 17:35 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/6 "2023-01-25T17:35:57Z")

</div>

> [@arlklauss](#):
>
> Futher, all mqtt in/out nodes keep trying to connect/send their messages including the one with invalid topic and thus it creates and infinite loop

This is a known (unanswered) issue: [bad topic causes disconnect event but then tries to resend on auto reconnect resulting in continuous error · Issue #1402 · mqttjs/MQTT.js · GitHub](https://github.com/mqttjs/MQTT.js/issues/1402)

---

<div class="post-metadata">

**Author:** ![arlklauss](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/arlklauss/32/64050_2.png) [@arlklauss](https://discourse.nodered.org/u/arlklauss)\
**Post date:** [25 January 2023 18:43 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/7 "2023-01-25T18:43:19Z")

</div>

Just the typical connect/disconnect messages:

25 Jan 14:27:00 - [info] [mqtt-broker:vernemq@xxxxxx] Connected to broker: nr-dev-klauss@mqtts://xxxxxxx:8884  
25 Jan 14:27:14 - [info] [mqtt-broker:vernemq@xxxxxx] Disconnected from broker: nr-dev-klauss@mqtts://nxxxxx:8884

I will try to capture the packages or if there are some other way to show more verbose messages, please let me know!

Thank You!

---

<div class="post-metadata">

**Author:** ![arlklauss](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/arlklauss/32/64050_2.png) [@arlklauss](https://discourse.nodered.org/u/arlklauss)\
**Post date:** [25 January 2023 18:46 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/8 "2023-01-25T18:46:59Z")

</div>

I'm thinking to use the status node to monitor the state of the connection and then send a "connect" command to "break" the loop (it worked manually , until it receives the unauthorized/invalid topic again). Not sure if it is an elegant way to solve it.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [25 January 2023 18:49 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/9 "2023-01-25T18:49:25Z")

</div>

Not sure apart from "don't send invalid topics" - and just to clarify, you mean topics that are "protected" (not badly formatted topics right?)

---

<div class="post-metadata">

**Author:** ![greengolfer](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/greengolfer/32/28276_2.png) [@greengolfer](https://discourse.nodered.org/u/greengolfer)\
**Post date:** [25 January 2023 20:19 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/10 "2023-01-25T20:19:24Z")

</div>

As suggested by @Colin if all mqtt nodes are using the same configuration node as you explain in the 1st email, then all in/out are sharing the same client\_id. VerneMQ disconnection is based on the client\_id. So, if one is doing something dodgy then the client\_id is "banned" (that is disconnected).

If there is a risk that one mqtt out is behaving badly, then, you can create multiple config nodes to the same broker and only this one will be affected.

---

<div class="post-metadata">

**Author:** ![greengolfer](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/greengolfer/32/28276_2.png) [@greengolfer](https://discourse.nodered.org/u/greengolfer)\
**Post date:** [25 January 2023 20:21 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/11 "2023-01-25T20:21:28Z")

</div>

> [@Steve-Mcl](#):
>
> Does Vernemq have a free online public MQTT broker where I can test this?

It does not... However, for test purposes you can use the docker image available here: [Docker](https://hub.docker.com/r/vernemq/vernemq/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [26 March 2023 20:22 UTC](https://discourse.nodered.org/t/mqtt-clients-connect-behavior-when-pub-sub-to-an-unauthorized-topic/74183/12 "2023-03-26T20:22:04Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.