alibaba/Sentinel · error · IllegalStateException

You must set either 'password' or 'authorization'

Error message

You must set either 'password' or 'authorization'

What it means

Thrown by SentinelRuleLocator.addAuthorizationToken() when BOTH a password and an Authorization header are configured for the Config Server request. The method must choose one auth mechanism; supplying both is ambiguous, so it refuses instead of silently picking one.

Source

Thrown at sentinel-extension/sentinel-datasource-spring-cloud-config/src/main/java/com/alibaba/csp/sentinel/datasource/spring/cloud/config/SentinelRuleLocator.java:261

        Map<String, String> headers = new HashMap<>(client.getHeaders());
        if (headers.containsKey(AUTHORIZATION)) {
            // To avoid redundant addition of header
            headers.remove(AUTHORIZATION);
        }
        if (!headers.isEmpty()) {
            template.setInterceptors(Arrays.<ClientHttpRequestInterceptor>asList(
                new GenericRequestHeaderInterceptor(headers)));
        }

        return template;
    }

    private void addAuthorizationToken(ConfigClientProperties configClientProperties,
                                       HttpHeaders httpHeaders, String username, String password) {
        String authorization = configClientProperties.getHeaders().get(AUTHORIZATION);

        if (password != null && authorization != null) {
            throw new IllegalStateException(
                "You must set either 'password' or 'authorization'");
        }

        if (password != null) {
            byte[] token = Base64Utils.encode((username + ":" + password).getBytes());
            httpHeaders.add("Authorization", "Basic " + new String(token));
        } else if (authorization != null) {
            httpHeaders.add("Authorization", authorization);
        }

    }

    public void setRestTemplate(RestTemplate restTemplate) {
        this.restTemplate = restTemplate;
    }

    public static class GenericRequestHeaderInterceptor
        implements ClientHttpRequestInterceptor {

View on GitHub (pinned to a3f40ba8e9)

Solutions

1. Remove one mechanism: delete the password/username properties and keep only headers.Authorization (or vice versa).
2. Check overlay/merged configs (application.yml + profile files + env vars) — the two settings may come from different files.
3. Prefer the Authorization header for token-based auth (OAuth2/JWT gateways); keep username/password only for basic auth.

Example fix

# before
spring.cloud.config:
  username: user
  password: secret
  headers:
    Authorization: Bearer ${token}   # both set -> throws

# after
spring.cloud.config:
  headers:
    Authorization: Bearer ${token}   # single auth mechanism

// before starting, assert only one auth mechanism is configured
boolean hasPassword = configClientProperties.getPassword() != null;
boolean hasAuthHeader = configClientProperties.getHeaders().containsKey("Authorization");
if (hasPassword && hasAuthHeader) {
    throw new IllegalStateException("configure EITHER password OR Authorization header, not both");
}

try {
    ruleLocator.locate(environment);
} catch (IllegalStateException e) {
    if (e.getMessage() != null && e.getMessage().contains("'password' or 'authorization'")) {
        throw new IllegalStateException("remove spring.cloud.config.password or the Authorization header (keep one)", e);
    }
    throw e;
}

When it happens

Trigger: Config client properties contain spring.cloud.config.password (or username/password pair) AND a custom header spring.cloud.config.headers.Authorization=Bearer ... at the same time.

Common situations: Migrating from basic auth to token auth: the old password properties are left in the YAML while the new Authorization header is added; shared base config sets the password while an environment overlay adds the header.

Related errors

• Invalid Value for Read Timeout set.
• Could not locate PropertySource and the fail fast property i
• Bad argument: ruleKey=[%s]
• File can't be null or a directory
• charset can't be null

AI-assisted analysis of alibaba/Sentinel@a3f40ba8e9 (2026-08-14). Data as JSON: /api/errors/ce4e407e7b1fe2ea. Report an issue: GitHub.