{"record":{"id":"024bb0f23b4f98f0","repo":"microsoft/playwright","slug":"invalid-http-credentials-format-use-username-pas","errorCode":null,"errorMessage":"Invalid http credentials format: use \"username:password\", for example --http-credentials=\"admin:secret\"","messagePattern":"Invalid http credentials format: use \"username:password\", for example --http-credentials=\"admin:secret\"","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/playwright-core/src/cli/browserActions.ts","lineNumber":134,"sourceCode":"  if (options.geolocation) {\n    try {\n      const [latitude, longitude] = options.geolocation.split(',').map(n => parseFloat(n.trim()));\n      contextOptions.geolocation = {\n        latitude,\n        longitude\n      };\n    } catch (e) {\n      throw new Error('Invalid geolocation format, should be \"lat,long\". For example --geolocation=\"37.819722,-122.478611\"');\n    }\n    contextOptions.permissions = ['geolocation'];\n  }\n\n  // HTTP credentials\n\n  if (options.httpCredentials) {\n    const separator = options.httpCredentials.indexOf(':');\n    if (separator === -1)\n      throw new Error('Invalid http credentials format: use \"username:password\", for example --http-credentials=\"admin:secret\"');\n    contextOptions.httpCredentials = {\n      username: options.httpCredentials.substring(0, separator),\n      password: options.httpCredentials.substring(separator + 1),\n    };\n  }\n\n  // User agent\n\n  if (options.userAgent)\n    contextOptions.userAgent = options.userAgent;\n\n  // Lang\n\n  if (options.lang)\n    contextOptions.locale = options.lang;\n\n  // Color scheme\n","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/microsoft/playwright/blob/9642f57665db582b12dcfa5d8022808f2402fa2a/packages/playwright-core/src/cli/browserActions.ts#L116-L152","documentation":"Playwright's CLI (`playwright open`, `playwright cr`, etc.) throws this while converting the `--http-credentials` string option into the httpCredentials context option. The parser at browserActions.ts:131-139 splits on the first ':' to build {username, password}; if the value contains no colon at all, the format is unusable and it aborts before launching the browser.","triggerScenarios":"Passing `--http-credentials` without a ':' separator, e.g. `npx playwright open --http-credentials=admin` (password forgotten), `--http-credentials=admin secret` (space splits into two args), or a URL-style value like `--http-credentials=http://admin:secret` only works if a colon exists anywhere, but bare `admin` or `secret123` has none. Any value where `options.httpCredentials.indexOf(':') === -1` triggers it.","commonSituations":"Forgetting the `username:password` syntax; shell quoting that splits the value at the space so only the username reaches the flag; scripts that interpolate credentials from env vars that are undefined or hold only a username; empty password cases where the user omits the trailing colon.","solutions":["Use the exact `username:password` format, quoting the whole flag value: `npx playwright open --http-credentials=\"admin:secret\"`.","For an empty password keep the separator: `--http-credentials=\"admin:\"`.","If building the flag programmatically, validate the env value contains ':' before spawning the CLI (see validationCode) so misconfiguration fails with your own message."],"exampleFix":"# before\nnpx playwright open --http-credentials=admin https://example.com\n# Error: Invalid http credentials format...\n\n# after\nnpx playwright open --http-credentials=\"admin:secret\" https://example.com","handlingStrategy":"validation","validationCode":"// Validate before spawning the CLI\nconst creds = process.env.BASIC_AUTH; // e.g. \"admin:secret\"\nif (!creds || !creds.includes(':'))\n  throw new Error(`BASIC_AUTH must be \"username:password\", got: ${creds ?? '(unset)'}`);\nconst args = ['open', `--http-credentials=${creds}`, url];","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always quote the whole flag value in shells: --http-credentials=\"admin:secret\".","Keep an empty password explicit with a trailing colon (\"admin:\").","When credentials come from env vars or secret stores, assert the 'username:password' shape in a startup check, not at CLI spawn time."],"tags":["cli","http-authentication","credentials","input-validation","launch-options"],"backgroundTag":"invalid-cli-argument","analyzedSha":"9642f57665db582b12dcfa5d8022808f2402fa2a","analyzedAt":"2026-08-21T16:56:32.694Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}