apache/pulsar · error · AuthenticationException

Invalid HTTP Authorization header

Error message

Invalid HTTP Authorization header

What it means

AuthenticationProviderToken.authenticateHttpRequest() validates HTTP requests for token auth. It requires an Authorization header present and starting with the expected prefix ("Bearer "). It throws this AuthenticationException when the header is missing entirely or has a malformed scheme (e.g. missing 'Bearer ' prefix, wrong case handled elsewhere, or 'Basic' auth sent instead).

Source

Thrown at pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java:184

        try {
            // Get Token
            token = getToken(authData);
        } catch (AuthenticationException exception) {
            incrementFailureMetric(ErrorCode.INVALID_AUTH_DATA);
            throw exception;
        }
        // Parse Token by validating
        String role = getPrincipal(authenticateToken(token));
        authenticationMetricsToken.recordSuccess();
        return role;
    }

    @Override
    public boolean authenticateHttpRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {
        HttpServletRequestWrapper wrappedRequest = new HttpServletRequestWrapper(request);
        String httpHeaderValue = wrappedRequest.getHeader(HTTP_HEADER_NAME);
        if (httpHeaderValue == null || !httpHeaderValue.startsWith(HTTP_HEADER_VALUE_PREFIX)) {
            throw new AuthenticationException("Invalid HTTP Authorization header");
        }
        AuthenticationDataSource authenticationDataSource = new AuthenticationDataHttps(wrappedRequest);
        String role = authenticate(authenticationDataSource);
        request.setAttribute(AuthenticatedRoleAttributeName, role);
        request.setAttribute(AuthenticatedDataAttributeName, authenticationDataSource);
        return true;
    }

    @Override
    public AuthenticationState newAuthState(AuthData authData, SocketAddress remoteAddress, SSLSession sslSession)
            throws AuthenticationException {
        return new TokenAuthenticationState(this, authData, remoteAddress, sslSession);
    }

    @Override
    public AuthenticationState newHttpAuthState(HttpServletRequest request) throws AuthenticationException {
        return new TokenAuthenticationState(this, new HttpServletRequestWrapper(request));
    }

View on GitHub (pinned to 820761864e)

Solutions

1. Send the header as 'Authorization: Bearer <token>' with the exact prefix
2. Check that proxies/gateways are not stripping or rewriting the Authorization header
3. Confirm the endpoint's configured auth provider expects token (Bearer) auth and you're not mixing auth methods

Example fix

# before
curl -H "Authorization: eyJhbGciOi..." https://broker:8080/admin/v2/clusters
// after
curl -H "Authorization: Bearer eyJhbGciOi..." https://broker:8080/admin/v2/clusters

String auth = request.getHeader("Authorization");
boolean valid = auth != null && auth.startsWith("Bearer ");
if (!valid) {
    throw new AuthenticationException("Invalid HTTP Authorization header");
}

boolean isBearerHeader(String h) { return h != null && h.startsWith("Bearer "); }

try {
    provider.authenticateHttpRequest(request, response);
} catch (Exception e) {
    response.sendError(401, "Missing or malformed Authorization: Bearer header");
}

When it happens

Trigger: An HTTP request hitting the token-authenticated web endpoint with: no Authorization header; header not starting with 'Bearer '; or a non-Bearer scheme like Basic/Negotiate.

Common situations: Curl/API calls that omit the -H 'Authorization: Bearer <token>' header; clients using HTTP Basic auth instead of Bearer; reverse proxies stripping the Authorization header; case errors like 'bearer' depending on prefix matching.

Related errors

• ERROR_VERIFYING_JWT
• ERROR_RETRIEVING_PUBLIC_KEY
• Failed to authentication http request
• No token credentials passed
• Audiences in token: [${object}] not contains this broker: ${

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/4bb2e02445359373. Report an issue: GitHub.