AlistGo/alist · error

authorization should not include Basic prefix

Error message

authorization should not include Basic prefix

What it means

credentialState() detected that the Authorization field starts with 'Basic ' (case-insensitive). The 139 driver expects the raw Authorization token value only — it sends it directly in headers — so a Basic-auth prefixed string is a user configuration mistake, not a server condition.

Source

Thrown at drivers/139/util.go:1283

		log.Infof("139yun: fast login failed or not possible, performing full password login (Step 1).")
		_, err := d.loginWithPassword()
		if err != nil {
			return fmt.Errorf("login with password failed: %w", err)
		}
		return nil
	default:
		return fmt.Errorf("unsupported credential state: %d", state)
	}
}

func (d *Yun139) credentialState() (credentialState, error) {
	d.Authorization = strings.TrimSpace(d.Authorization)
	d.Username = strings.TrimSpace(d.Username)
	d.MailCookies = strings.TrimSpace(d.MailCookies)

	if d.Authorization != "" {
		if strings.HasPrefix(strings.ToLower(d.Authorization), "basic ") {
			return 0, fmt.Errorf("authorization should not include Basic prefix")
		}
		return credentialStateAuthorization, nil
	}

	if d.MailCookies != "" && !hasCookiePair(d.MailCookies) {
		return 0, fmt.Errorf("MailCookies format is invalid, please check your configuration")
	}

	hasUsername := d.Username != ""
	hasPassword := strings.TrimSpace(d.Password) != ""
	hasCookies := d.MailCookies != ""
	if hasUsername || hasPassword {
		if !hasUsername || !hasPassword || !hasCookies {
			return 0, fmt.Errorf("if username or password is provided, all three (mail_cookies, username, password) must be provided")
		}
		return credentialStateFullLogin, nil
	}

View on GitHub (pinned to 843d9dc814)

Solutions

1. Edit the storage config and remove the 'Basic ' prefix, keeping only the token string
2. Save and reload the storage so login state is re-evaluated
3. If unsure what the token is, extract just the value from the Authorization header shown in browser devtools (strip scheme and space)

Example fix

# before (config)
authorization: "Basic aaaabbbb..."
# after
authorization: "aaaabbbb..."

// Check before saving the storage config
if strings.HasPrefix(strings.ToLower(strings.TrimSpace(auth)), "basic ") {
	return errors.New("authorization must be the bare token, without the 'Basic ' prefix")
}

func isBareToken(auth string) bool {
	auth = strings.TrimSpace(auth)
	return auth != "" && !strings.HasPrefix(strings.ToLower(auth), "basic ")
}

// Config errors need user action, not retries — surface immediately
if err != nil && strings.Contains(err.Error(), "Basic prefix") {
	return errors.New("remove the 'Basic ' prefix from the Authorization field")
}

When it happens

Trigger: User copied 'Basic <token>' from browser devtools/curl examples into the storage's Authorization field instead of just the token.

Common situations: Following documentation for a different driver or HTTP examples that show the full header value 'Authorization: Basic xxxx' and pasting it verbatim.

Related errors

• api_key is empty
• cookie is empty
• empty token
• authorization is empty and credentials are not provided
• remote_path is required

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/5fc012c487da0f01. Report an issue: GitHub.