apache/dubbo · error · IllegalArgumentException

Invalid url, password without username!

Error message

Invalid url, password without username!

What it means

Thrown by the public URL constructor when a password is supplied without a username (username empty, password non-empty). Dubbo URL semantics treat credentials as a pair, so a lone password is rejected as malformed at construction time with an IllegalArgumentException.

Source

Thrown at dubbo-common/src/main/java/org/apache/dubbo/common/URL.java:195

    public URL(String protocol, String username, String password, String host, int port, String path) {
        this(protocol, username, password, host, port, path, (Map<String, String>) null);
    }

    public URL(String protocol, String username, String password, String host, int port, String path, String... pairs) {
        this(protocol, username, password, host, port, path, CollectionUtils.toStringMap(pairs));
    }

    public URL(
            String protocol,
            String username,
            String password,
            String host,
            int port,
            String path,
            Map<String, String> parameters) {
        if (StringUtils.isEmpty(username) && StringUtils.isNotEmpty(password)) {
            throw new IllegalArgumentException("Invalid url, password without username!");
        }

        this.urlAddress = new PathURLAddress(protocol, username, password, path, host, port);
        this.urlParam = URLParam.parse(parameters);
        this.attributes = null;
    }

    protected URL(
            String protocol,
            String username,
            String password,
            String host,
            int port,
            String path,
            Map<String, String> parameters,
            boolean modifiable) {
        if (StringUtils.isEmpty(username) && StringUtils.isNotEmpty(password)) {
            throw new IllegalArgumentException("Invalid url, password without username!");

View on GitHub (pinned to 3a3043227f)

Solutions

1. Supply a non-empty username whenever a password is set, or clear both credentials if authentication is not needed.
2. Fix the source URL string so the userinfo is either 'user:pass@', 'user@', or absent (never ':pass@').
3. Validate credentials in config loading before constructing the URL and fail with a clear config error.

Example fix

// before
new URL("nacos", "", "secret", "host", 8848, path, params); // throws

// after
new URL("nacos", "appUser", "secret", "host", 8848, path, params);

// Validate credential pairing before constructing the URL
if ((username == null || username.isEmpty()) && password != null && !password.isEmpty()) {
    throw new IllegalArgumentException("refusing to build URL: password without username");
}

When it happens

Trigger: Constructing a new URL(...) directly with a non-empty password and an empty/null username; parsing/transforming a connection string where the userinfo lost its username but kept the password (e.g. ":secret@host"); programmatically building a URL and setting only setPassword.

Common situations: Registry/broker URLs with credentials where the username was accidentally dropped during templating or config interpolation; misformatted credentials in properties/yaml (e.g. password set, username left blank); migrating a URL string and stripping the userinfo incorrectly.

Related errors

• Invalid url, password without username!
• url missing protocol: "${fullURLStr}"
• The address of metadata report is invalid.
• Invalid configurator rule, please specify at least one param
• service field in configuration is null.

AI-assisted analysis of apache/dubbo@3a3043227f (2026-08-14). Data as JSON: /api/errors/792356d084565410. Report an issue: GitHub.