apache/dubbo · error · IllegalArgumentException

Invalid url, password without username!

Error message

Invalid url, password without username!

What it means

Thrown by URLBuilder.build() when the assembled URL has a password but no username. URLBuilder enforces the same credential-pair rule as the URL constructors at the moment the immutable ServiceConfigURL is produced, so malformed credentials surface during URL building rather than at first use.

Source

Thrown at dubbo-common/src/main/java/org/apache/dubbo/common/URLBuilder.java:133

        this.parameters = parameters != null ? parameters : new HashMap<>();
        this.attributes = attributes != null ? attributes : new HashMap<>();
    }

    public static URLBuilder from(URL url) {
        String protocol = url.getProtocol();
        String username = url.getUsername();
        String password = url.getPassword();
        String host = url.getHost();
        int port = url.getPort();
        String path = url.getPath();
        Map<String, String> parameters = new HashMap<>(url.getParameters());
        Map<String, Object> attributes = new HashMap<>(url.getAttributes());
        return new URLBuilder(protocol, username, password, host, port, path, parameters, attributes);
    }

    public ServiceConfigURL build() {
        if (StringUtils.isEmpty(username) && StringUtils.isNotEmpty(password)) {
            throw new IllegalArgumentException("Invalid url, password without username!");
        }
        port = Math.max(port, 0);
        // trim the leading "/"
        int firstNonSlash = 0;
        if (path != null) {
            while (firstNonSlash < path.length() && path.charAt(firstNonSlash) == '/') {
                firstNonSlash++;
            }
            if (firstNonSlash >= path.length()) {
                path = "";
            } else if (firstNonSlash > 0) {
                path = path.substring(firstNonSlash);
            }
        }
        return new ServiceConfigURL(protocol, username, password, host, port, path, parameters, attributes);
    }

    @Override

View on GitHub (pinned to 3a3043227f)

Solutions

1. Always set both username and password together, or clear both when authentication is not required.
2. Validate credentials on the builder before build(): if password is non-blank, require a non-blank username.
3. Source the credentials from a single Credential object so they cannot drift apart.

Example fix

// before
URL u = new URLBuilder().setProtocol("nacos").setPassword("secret").setHost("h").setPort(8848).build(); // throws

// after
URL u = new URLBuilder().setProtocol("nacos").setUsername("app").setPassword("secret").setHost("h").setPort(8848).build();

// Validate on the builder before build()
if ((username == null || username.isEmpty()) && password != null && !password.isEmpty()) {
    throw new IllegalArgumentException("URLBuilder: password without username");
}
url = builder.build();

When it happens

Trigger: Calling URLBuilder.setUsername("") (or never setting username) while setPassword(...) is non-empty, then invoking build(); or copying a URL into a builder and clearing the username but leaving the password. The IllegalArgumentException is raised at build() time.

Common situations: Programmatic URL construction for dynamic registries/protocols where the username was conditionally set and ended up empty; clearing credentials partially during URL rewriting; templating that interpolates an empty username; transforming one URL into another and dropping userinfo incorrectly.

Related errors

• Invalid url, password without username!
• Map pairs can not be odd number.
• url missing protocol: "${fullURLStr}"
• The address of metadata report is invalid.
• Invalid configurator rule, please specify at least one param

AI-assisted analysis of apache/dubbo@3a3043227f (2026-08-14). Data as JSON: /api/errors/c6427458f0412e21. Report an issue: GitHub.