apache/pulsar · error · AuthenticationException

Blank token found

Error message

Blank token found

What it means

validateToken() is the first step of token processing in AuthenticationProviderToken; it only checks that the token string is not blank. It throws this AuthenticationException when the extracted token (from command data or after stripping the Bearer prefix) is null, empty, or whitespace-only.

Source

Thrown at pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java:228

            // (https://tools.ietf.org/html/rfc6750#section-2.1). Eg: Authorization: Bearer xxxxxxxxxxxxx
            String httpHeaderValue = authData.getHttpHeader(HTTP_HEADER_NAME);
            if (httpHeaderValue == null || !httpHeaderValue.startsWith(HTTP_HEADER_VALUE_PREFIX)) {
                throw new AuthenticationException("Invalid HTTP Authorization header");
            }

            // Remove prefix
            String token = httpHeaderValue.substring(HTTP_HEADER_VALUE_PREFIX.length());
            return validateToken(token);
        } else {
            throw new AuthenticationException("No token credentials passed");
        }
    }

    private static String validateToken(final String token) throws AuthenticationException {
        if (StringUtils.isNotBlank(token)) {
            return token;
        } else {
            throw new AuthenticationException("Blank token found");
        }
    }

    @SuppressWarnings("unchecked")
    private Jws<Claims> authenticateToken(final String token) throws AuthenticationException {
        try {
            Jws<Claims> jwt = parser.parseClaimsJws(token);

            if (audienceClaim != null) {
                Object object = jwt.getBody().get(audienceClaim);
                if (object == null) {
                    throw new JwtException("Found null Audience in token, for claimed field: " + audienceClaim);
                }

                if (object instanceof Collection) {
                    Collection<String> audiences = (Collection<String>) object;
                    // audience not contains this broker, throw exception.
                    if (audiences.stream().noneMatch(audienceInToken -> audienceInToken.equals(audience))) {

View on GitHub (pinned to 820761864e)

Solutions

1. Provide a non-blank token value in authParams or the Bearer header
2. If loading the token from a file, verify the file has content and trim whitespace/newlines
3. Regenerate the token with the pulsar tokens CLI if it was accidentally deleted or emptied

Example fix

// before
authParams=file:///etc/pulsar/token  // file is empty
// after
bin/pulsar tokens create --private-key /path/private.pem --subject admin > /etc/pulsar/token
authParams=file:///etc/pulsar/token

String token = readTokenFromFile(path);
if (token == null || token.isBlank()) {
    throw new IllegalArgumentException("Token file " + path + " is empty");
}

boolean isUsableToken(String t) { return t != null && !t.isBlank(); }

try {
    role = provider.authenticate(authData);
} catch (AuthenticationException e) {
    log.warn("Blank token supplied; regenerate token via pulsar tokens create", e);
}

When it happens

Trigger: getToken() passes a token to validateToken() that is null, empty, or blank — e.g. an Authorization header of exactly 'Bearer ' with no token, or authParams containing an empty token value.

Common situations: Empty token file (token read from file whose contents are blank or only newline); clients with authParams=token: (empty value); header 'Bearer' with trailing whitespace but no token.

Related errors

• ${name} is NULL, empty or contains a '&'
• Token Audience Claim [${audienceClaim}] configured, but Audi
• No token credentials passed
• Found null Audience in token, for claimed field: ${audienceC
• Audiences in token: [${audiences}] not contains this broker:

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/5bfc413a164d659c. Report an issue: GitHub.