apache/pulsar · error · RestException

Failed to get clientId from request

Error message

Failed to get clientId from request

What it means

WebSocketWebResource.clientAppId authenticates the HTTP request; if AuthenticationService.authenticateHttpRequest throws AuthenticationException and authentication is enabled, it returns HTTP 401 'Failed to get clientId from request'. This means the request carried credentials that could not be validated, so the calling role cannot be determined.

Source

Thrown at pulsar-websocket/src/main/java/org/apache/pulsar/websocket/admin/WebSocketWebResource.java:86

    @SuppressWarnings("deprecation")
    public String clientAppId() {
        if (isBlank(clientId)) {
            try {
                String authMethodName = httpRequest.getHeader(AuthenticationFilter.PULSAR_AUTH_METHOD_NAME);
                if (authMethodName != null
                    && service().getAuthenticationService().getAuthenticationProvider(authMethodName) != null) {
                    authenticationDataSource = service().getAuthenticationService()
                            .getAuthenticationProvider(authMethodName)
                            .newHttpAuthState(httpRequest).getAuthDataSource();
                    clientId = service().getAuthenticationService().authenticateHttpRequest(
                            httpRequest, authenticationDataSource);
                } else {
                    clientId = service().getAuthenticationService().authenticateHttpRequest(httpRequest);
                    authenticationDataSource = new AuthenticationDataHttps(httpRequest);
                }
            } catch (AuthenticationException e) {
                if (service().getConfig().isAuthenticationEnabled()) {
                    throw new RestException(Status.UNAUTHORIZED, "Failed to get clientId from request");
                }
            }

            if (isBlank(clientId) && service().getConfig().isAuthenticationEnabled()) {
                throw new RestException(Status.UNAUTHORIZED, "Failed to get auth data from the request");
            }
        }
        return clientId;
    }

    public AuthenticationDataSource authData() throws AuthenticationException {
        return authenticationDataSource;
    }

    /**
     * Checks whether the user has Pulsar Super-User access to the system.
     *
     * @throws RestException

View on GitHub (pinned to 820761864e)

Solutions

1. Refresh the token/credentials and resend with a correct 'Authorization: Bearer <token>' header
2. Confirm the proxy's authenticationProviders and token signing key match your client's credentials
3. Check for clock skew causing premature JWT expiry validation failures
4. If auth is intentionally off, verify authenticationEnabled=false is actually applied to the proxy config

Example fix

// before
curl http://proxy:8080/admin/v2/websocket/stats/my-topic
// after
curl -H "Authorization: Bearer $TOKEN" http://proxy:8080/admin/v2/websocket/stats/my-topic

// before calling: ensure a non-empty, syntactically valid credential is attached
if (token == null || token.isBlank()) { throw new IllegalStateException("auth token missing; will get 401"); }

boolean hasBearerAuth(HttpRequest req) { String h = req.getHeader("Authorization"); return h != null && h.startsWith("Bearer ") && h.length() > 7; }

try { return clientAppId(); } catch (WebApplicationException e) { if (e.getResponse().getStatus() == 401 && e.getMessage().contains("clientId")) { refreshToken(); return clientAppId(); } throw e; }

When it happens

Trigger: Admin REST call against the websocket proxy with an invalid/expired/malformed auth token or cookie while authenticationEnabled=true; the Authorization header fails the configured authentication provider.

Common situations: Expired JWT; token signed by a key the proxy doesn't trust; missing/wrong Authorization header scheme (e.g. 'Basic' vs 'Bearer'); proxy configured with a different auth provider than the client library.

Related errors

• Failed to get auth data from the request
• Invalid broker configuration. Authentication must be enabled
• Label name cannot be null or empty
• domain() invoked from wrong resource
• Unauthorized to validateBothSuperuserAndClusterOperation for

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/9b8cd7f2a6bced66. Report an issue: GitHub.