🐰 RabbitMQ Error: STOMP plugin CONNECT error / authentication failed

Exact Error Message

A STOMP client sending a CONNECT frame to a broker that rejects authentication receives an ERROR frame and the connection is closed:

ERROR
message:Bad CONNECT
content-type:text/plain
version:1.0,1.1,1.2

Access refused for user 'events-svc'
^@

If the rabbitmq_stomp plugin is not enabled or port 61613 is blocked, the client cannot even send CONNECT and fails at the socket:

Error: connect ECONNREFUSED 10.0.4.21:61613

The broker log records the rejected login:

2026-07-17 13:41:07.559 [warning] <0.1620.0> STOMP connection from 10.0.8.19:53880 rejected:
 access_refused for user 'events-svc' on vhost '/'

What It Means

RabbitMQ speaks STOMP through the rabbitmq_stomp plugin. Like the other protocol plugins it uses a dedicated listener — 61613 for plaintext and 61614 for TLS — separate from AMQP’s 5672. STOMP is a simple text framing protocol: the client opens with a CONNECT (or STOMP) frame carrying login and passcode headers, and the broker replies with either a CONNECTED frame on success or an ERROR frame on failure.

A CONNECT error therefore means one of two layers failed. Either the TCP connection was refused (plugin not enabled or port blocked), or the frame was received but the broker rejected the login — wrong credentials, a user without permission on the requested vhost, or an unsupported protocol version. STOMP also negotiates heart-beat headers and uses destination prefixes (/queue/, /exchange/, /topic/, /amq/queue/) that must map to real topology.

Common Causes

• The rabbitmq_stomp plugin is not enabled.
• Port 61613/61614 is blocked by a firewall or bound to the wrong interface.
• Wrong login/passcode, or the client sends none while default-user login is disabled.
• The user lacks permissions on the vhost passed in the host header of the CONNECT frame.
• Using the localhost-only guest user from a remote client.
• A destination prefix references an exchange or queue that does not exist.

Diagnostic Commands

Confirm the plugin is enabled:

rabbitmq-plugins list -e | grep stomp

Confirm the STOMP listener is bound and on which port:

rabbitmq-diagnostics listeners | grep -i stomp

Verify credentials and the vhost permissions the client requests:

rabbitmqctl authenticate_user events-svc 'REDACTED'
rabbitmqctl list_permissions --vhost /

Watch the log during a connect attempt for the ERROR/access_refused cause:

journalctl -u rabbitmq-server --since "5 min ago" | grep -iE 'stomp|access_refused|bad connect'

Step-by-Step Resolution

1. Enable the plugin if it is missing, then reconnect:

   rabbitmq-plugins enable rabbitmq_stomp

2. Confirm the listener is up on 61613 (or 61614 for TLS):

   rabbitmq-diagnostics listeners | grep -i stomp

3. Check network reachability from the client host if the socket is refused:

   nc -zv 10.0.4.21 61613

4. Fix the login. For an Access refused ERROR frame, correct the login/passcode headers and verify them:

   rabbitmqctl authenticate_user events-svc 'the-password'

5. Grant vhost permissions matching the host header the client sends in CONNECT:

   rabbitmqctl set_permissions -p / events-svc ".*" ".*" ".*"

6. Handle default/anonymous logins deliberately. If clients omit credentials, configure stomp.default_user/stomp.default_pass in rabbitmq.conf instead of relying on guest, which only works from localhost. Also confirm the client and broker agree on a STOMP version and heart-beat.

7. Verify the connection succeeds and shows as STOMP:

   rabbitmqctl list_connections name protocol user state | grep -i stomp

Prevention

• Enable rabbitmq_stomp during provisioning so the listener always exists after a rebuild.
• Manage firewall/security-group rules for 61613/61614 with the broker deployment.
• Use dedicated per-client credentials and avoid the localhost-only guest user for remote STOMP clients.
• Ensure the vhost in the CONNECT host header matches where the user has permissions.
• Pre-declare the exchanges/queues that STOMP destination prefixes resolve to, and monitor ERROR-frame rates. The prompt library has prompts for building STOMP client-onboarding and auth checklists.

Related Errors

• Web-STOMP WebSocket failed — the browser variant over rabbitmq_web_stomp, a separate listener.
• MQTT connection refused — the analogous plugin/port/auth failure on the MQTT plugin.
• access_refused (403) — the same authorization failure surfaced on the AMQP protocol.
• connection refused — nothing listening on the port, identical root cause to an unenabled plugin.

Frequently Asked Questions

Why does my STOMP client get ECONNREFUSED? No listener answered — usually the rabbitmq_stomp plugin is not enabled or port 61613 is blocked by a firewall.

What port does RabbitMQ STOMP use? 61613 for plaintext and 61614 for TLS, separate from AMQP’s 5672 and management’s 15672.

Why do I get an ERROR frame saying access refused? The CONNECT frame reached the broker but the login/passcode was wrong, or the user lacks permission on the vhost named in the host header.

Can I use the guest user over STOMP remotely? No — guest is restricted to localhost by default. Configure stomp.default_user/stomp.default_pass or send explicit credentials.

How do STOMP destinations map to RabbitMQ? Prefixes like /queue/, /exchange/, and /topic/ map to queues and exchanges, which must exist and be permitted for the user. For more, see the RabbitMQ guides.