alibaba/nacos · warning · IllegalArgumentException

username '__nacos_anonymous__' is reserved by the system

Error message

username '__nacos_anonymous__' is reserved by the system

What it means

The username __nacos_anonymous__ is the internal sentinel for unauthenticated/anonymous principals; letting it be created or deleted would let someone impersonate the anonymous identity or break anonymous-access semantics. rejectReservedUsername() throws IllegalArgumentException whenever a user-management operation targets that exact name.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/users/AbstractCachedUserService.java:70

            
            Map<String, User> map = new ConcurrentHashMap<>(16);
            for (User user : users.getPageItems()) {
                map.put(user.getUsername(), user);
            }
            userMap = map;
        } catch (Exception e) {
            Loggers.AUTH.warn("[LOAD-USERS] load failed", e);
        }
    }
    
    /**
     * Reject reserved system usernames from being created or deleted.
     *
     * @param username the username to check
     */
    protected void rejectReservedUsername(String username) {
        if (AuthConstants.ANONYMOUS_USER.equals(username)) {
            throw new IllegalArgumentException(
                "username '" + AuthConstants.ANONYMOUS_USER + "' is reserved by the system");
        }
    }
    
    /**
     * [ISSUE #13625] check username and password is blank.
     */
    protected void validateUserCredentials(String username, String password) {
        if (StringUtils.isBlank(username)) {
            throw new IllegalArgumentException("username is blank");
        }
        rejectReservedUsername(username);
        if (StringUtils.isBlank(password)) {
            throw new IllegalArgumentException("password is blank");
        }
    }
}

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Skip or rename the reserved username in your provisioning input.
2. Add a client-side guard that blocks the literal '__nacos_anonymous__' before calling the API.
3. Audit role/permission scripts for the same sentinel name.

Example fix

// before
userService.createUser("__nacos_anonymous__", pwd, true); // IllegalArgumentException

// after
private static final Set<String> RESERVED = Set.of("__nacos_anonymous__", "nacos");
if (RESERVED.contains(username)) {
    throw new IllegalArgumentException("username is reserved: " + username);
}
userService.createUser(username, pwd, true);

// Block reserved usernames before any user-management call.
import com.alibaba.nacos.plugin.auth.impl.constant.AuthConstants;
import com.alibaba.nacos.common.utils.StringUtils;

if (StringUtils.isBlank(username)
        || AuthConstants.ANONYMOUS_USER.equals(username)) {
    throw new IllegalArgumentException("username is blank or reserved: " + username);
}

try {
    userService.createUser(username, password, false);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("reserved")) {
        return Result.failure(400, e.getMessage());
    }
    throw e;
}

When it happens

Trigger: Calling createUser('__nacos_anonymous__', password) or deleteUser('__nacos_anonymous__') via the user API, or any path that routes through validateUserCredentials/rejectReservedUsername with that username.

Common situations: Automated provisioning scripts iterating a name list that accidentally includes the reserved name; security testing/fuzzing of usernames; a UI that lets the user type any string.

Related errors

• user '{username}' not found!
• username is blank
• password is blank
• Request parameter `agentSpecCard` should not be null or empt
• Required parameter `agentSpecCard.name` is not present.

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/e367d0325bb70760. Report an issue: GitHub.