What causes "Password cannot be null" in alibaba/nacos?

Validate that the password is non-null before calling encode() — check at the controller or form-validation layer.

alibaba/nacos · error · IllegalArgumentException

Password cannot be null

Error message

Password cannot be null

What it means

Thrown by PasswordEncoderUtil.encode() when the raw password argument is null. This is a precondition check before passing the password to the SafeBcryptPasswordEncoder. The method does not accept null because BCrypt encoding of null would either NPE internally or produce meaningless output.

Solutions

Validate that the password is non-null before calling encode() — check at the controller or form-validation layer.
If the password is optional in your flow, provide a default or reject the request with a clear validation error before reaching encode().
Ensure all code paths that call createUser or updateUserPassword supply a non-null password.

Example fix

// before
String encoded = PasswordEncoderUtil.encode(password); // NPE if password is null

// after
if (password == null || password.isBlank()) {
    throw new IllegalArgumentException("Password is required");
}
String encoded = PasswordEncoderUtil.encode(password);

Defensive patterns

Strategy: validation

Validate before calling

// Validate password is non-null before encoding
if (raw == null) {
    throw new IllegalArgumentException("Password is required and cannot be null");
}
String encoded = PasswordEncoderUtil.encode(raw);

Type guard

public static boolean isEncodablePassword(String raw) {
    return raw != null;
}

Try / catch

try {
    String encoded = PasswordEncoderUtil.encode(rawPassword);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("cannot be null")) {
        // handle missing password at the UI/API layer
        return Result.failure("Password is required");
    }
    throw e;
}

Prevention

Always validate that password is non-null at the controller or form layer.
Use @NotNull or @NotBlank Bean Validation annotations on password fields in request models.
Never pass a potentially-null password variable to encode() without a null check.

When it happens

Trigger: Calling PasswordEncoderUtil.encode(null) directly, or passing a password variable that was never initialized / came from a missing form field / was set to null by upstream code.

Common situations: A user creation or password update form submitted without a password field; a configuration or migration script that passes null for a password; an API call where the password parameter is omitted and defaults to null in the Java binding.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/544f382abe1ce7ec. Report an issue: GitHub.

Appendix: source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/PasswordEncoderUtil.java:41

 * Password encoder tool.
 *
 * @author nacos
 */
public class PasswordEncoderUtil {
    
    public static Boolean matches(String raw, String encoded) {
        return new SafeBcryptPasswordEncoder().matches(raw, encoded);
    }
    
    /**
     * Encode password.
     *
     * @param raw password
     * @return encoded password
     */
    public static String encode(String raw) {
        if (raw == null) {
            throw new IllegalArgumentException("Password cannot be null");
        }
        if (raw.length() > AuthConstants.MAX_PASSWORD_LENGTH) {
            throw new IllegalArgumentException("Password length must not exceed "
                + AuthConstants.MAX_PASSWORD_LENGTH + " characters");
        }
        return new SafeBcryptPasswordEncoder().encode(raw);
    }
}

View on GitHub (pinned to 9b989acdf1)