{"record":{"id":"04cb453c4e9bb922","repo":"winsw/winsw","slug":"basic-auth-is-enabled-but-username-is-not-specifi","errorCode":null,"errorMessage":"Basic Auth is enabled, but username is not specified {ShortId}","messagePattern":"Basic Auth is enabled, but username is not specified (.+?)","errorType":"exception","errorClass":"InvalidDataException","httpStatus":null,"severity":"error","filePath":"src/WinSW.Core/Download.cs","lineNumber":99,"sourceCode":"\n            this.Auth = XmlHelper.EnumAttribute(n, \"auth\", AuthType.None);\n            this.Username = XmlHelper.SingleAttribute<string>(n, \"user\", null);\n            this.Password = XmlHelper.SingleAttribute<string>(n, \"password\", null);\n            this.UnsecureAuth = XmlHelper.SingleAttribute(n, \"unsecureAuth\", false);\n\n            if (this.Auth == AuthType.Basic)\n            {\n                // Allow it only for HTTPS or for UnsecureAuth\n                if (!this.From.StartsWith(\"https:\") && !this.UnsecureAuth)\n                {\n                    throw new InvalidDataException(\"Warning: you're sending your credentials in clear text to the server \" + this.ShortId +\n                                                   \"If you really want this you must enable 'unsecureAuth' in the configuration\");\n                }\n\n                // Also fail if there is no user/password\n                if (this.Username is null)\n                {\n                    throw new InvalidDataException(\"Basic Auth is enabled, but username is not specified \" + this.ShortId);\n                }\n\n                if (this.Password is null)\n                {\n                    throw new InvalidDataException(\"Basic Auth is enabled, but password is not specified \" + this.ShortId);\n                }\n            }\n        }\n\n        // Source: http://stackoverflow.com/questions/2764577/forcing-basic-authentication-in-webrequest\n        private static void SetBasicAuthHeader(WebRequest request, string username, string password)\n        {\n            string authInfo = username + \":\" + password;\n            authInfo = Convert.ToBase64String(Encoding.GetEncoding(\"ISO-8859-1\").GetBytes(authInfo));\n            request.Headers[\"Authorization\"] = \"Basic \" + authInfo;\n        }\n\n        /// <summary>","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/winsw/winsw/blob/1d0ee4a91bad596d5e7e9c360f2b39ef54674674/src/WinSW.Core/Download.cs#L81-L117","documentation":"With auth=\"Basic\" on a download, a user attribute is required. If Username is null after parsing attributes, construction throws InvalidDataException. This check runs after the cleartext guard, so it only fires once the http(s)/unsecureAuth condition is satisfied.","triggerScenarios":"<download auth=\"basic\" password=\"p\"/> with no user attribute, or auth=\"basic\" with neither credential.","commonSituations":"Configured Basic auth but only supplied a password; typo'd user as username; intended to use a different auth type.","solutions":["Add user=\"...\" to the download element.","If you didn't mean to use Basic auth, remove auth=\"basic\" (default is None).","Confirm the attribute is named user (not username)."],"exampleFix":"<!-- before -->\n<download from=\"https://srv/p\" auth=\"basic\" password=\"p\" />\n<!-- after -->\n<download from=\"https://srv/p\" auth=\"basic\" user=\"u\" password=\"p\" />","handlingStrategy":"validation","validationCode":"foreach (XmlElement dl in dom.DocumentElement!.SelectNodes(\"download\")!)\n    if (dl.GetAttribute(\"auth\").Equals(\"basic\", StringComparison.OrdinalIgnoreCase) && dl.GetAttribute(\"user\") is null or \"\")\n        throw new InvalidOperationException(\"Basic auth requires a user attribute\");","typeGuard":null,"tryCatchPattern":"try { /* download init */ }\ncatch (InvalidDataException ex) when (ex.Message.Contains(\"username is not specified\")) { /* add user */ }","preventionTips":["Attribute is named user (not username).","Provide both user and password for Basic auth.","Drop auth=\"basic\" if unused."],"tags":["security","authentication","network","download","winsw"],"backgroundTag":null,"analyzedSha":"1d0ee4a91bad596d5e7e9c360f2b39ef54674674","analyzedAt":"2026-08-13T15:26:09.332Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}