alibaba/nacos · warning · IllegalArgumentException

password is blank

Error message

password is blank

What it means

Second clause of validateUserCredentials(): after the username passes, a blank password is rejected before any remote call. A user cannot be created without a non-empty password.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/users/AbstractCachedUserService.java:84

     * @param username the username to check
     */
    protected void rejectReservedUsername(String username) {
        if (AuthConstants.ANONYMOUS_USER.equals(username)) {
            throw new IllegalArgumentException(
                "username '" + AuthConstants.ANONYMOUS_USER + "' is reserved by the system");
        }
    }
    
    /**
     * [ISSUE #13625] check username and password is blank.
     */
    protected void validateUserCredentials(String username, String password) {
        if (StringUtils.isBlank(username)) {
            throw new IllegalArgumentException("username is blank");
        }
        rejectReservedUsername(username);
        if (StringUtils.isBlank(password)) {
            throw new IllegalArgumentException("password is blank");
        }
    }
}

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Require a non-empty password in the client/UI before calling createUser.
2. Enforce a minimum password length in your own validation layer.
3. Surface a clear validation error instead of relying on the plugin exception.

Example fix

// before
userService.createUser(username, "", true); // -> IllegalArgumentException

// after
if (password == null || password.trim().isEmpty()) {
    return Result.failure(400, "password is required");
}
userService.createUser(username, password, true);

import com.alibaba.nacos.common.utils.StringUtils;

if (StringUtils.isBlank(password)) {
    throw new IllegalArgumentException("password is blank");
}
if (password.trim().length() < 8) {
    throw new IllegalArgumentException("password too short");
}

try {
    userService.createUser(username, password, false);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("password is blank")) {
        return Result.failure(400, "password is required");
    }
    throw e;
}

When it happens

Trigger: Calling createUser with a valid username but an empty or whitespace-only password.

Common situations: Password field left empty in a create-user form; API client sending null/empty password; password generator returning an empty value on error.

Related errors

• username is blank
• user '{username}' not found!
• username '__nacos_anonymous__' is reserved by the system
• e.getErrMsg()
• 500

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/aa507af93e2e7453. Report an issue: GitHub.