{"record":{"id":"0d3bb757166ff405","repo":"paascloud/paascloud-master","slug":"invalid-basic-authentication-token","errorCode":null,"errorMessage":"Invalid basic authentication token","messagePattern":"Invalid basic authentication token","errorType":"http","errorClass":"BadCredentialsException","httpStatus":401,"severity":"error","filePath":"paascloud-common/paascloud-common-core/src/main/java/com/paascloud/core/utils/RequestUtil.java","lineNumber":149,"sourceCode":"\t\treturn authHeader;\n\t}\n\n\tpublic static String[] extractAndDecodeHeader(String header) throws IOException {\n\n\t\tbyte[] base64Token = header.substring(6).getBytes(\"UTF-8\");\n\t\tbyte[] decoded;\n\t\ttry {\n\t\t\tdecoded = Base64.decode(base64Token);\n\t\t} catch (IllegalArgumentException e) {\n\t\t\tthrow new BadCredentialsException(\"Failed to decode basic authentication token\");\n\t\t}\n\n\t\tString token = new String(decoded, \"UTF-8\");\n\n\t\tint delim = token.indexOf(GlobalConstant.Symbol.MH);\n\n\t\tif (delim == -1) {\n\t\t\tthrow new BadCredentialsException(\"Invalid basic authentication token\");\n\t\t}\n\t\treturn new String[]{token.substring(0, delim), token.substring(delim + 1)};\n\t}\n}\n","sourceCodeStart":131,"sourceCodeEnd":154,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-common/paascloud-common-core/src/main/java/com/paascloud/core/utils/RequestUtil.java#L131-L154","documentation":"RequestUtil.extractAndDecodeHeader throws BadCredentialsException(\"Invalid basic authentication token\") when the decoded credentials string contains no ':' separator (GlobalConstant.Symbol.MH). Basic auth requires the decoded payload to be username:password; without the colon the token is structurally invalid.","triggerScenarios":"Calling extractAndDecodeHeader with a valid Base64 payload whose decoded value has no colon — e.g. Base64(\"adminsecret\") instead of Base64(\"admin:secret\"), or sending an OAuth-style bearer token under the Basic scheme.","commonSituations":"Client encoding only the username or only the password, forgetting the colon delimiter, or a frontend config bug putting a JWT in a Basic header.","solutions":["Encode the full username:password pair (colon required) as Base64 for the Basic header.","Verify client-side credential assembly; log the decoded token shape (without secrets) to debug.","If you meant Bearer auth, use the Authorization: Bearer scheme instead of Basic."],"exampleFix":"// before\nBase64.encode(\"adminsecret\")   // no colon\n// after\nBase64.encode(\"admin:secret\") // username:password","handlingStrategy":"try-catch","validationCode":"String decoded = new String(Base64.getDecoder().decode(header.substring(6)), StandardCharsets.UTF_8);\nif (decoded.indexOf(':') < 0) {\n    throw new BadCredentialsException(\"decoded basic token must contain username:password\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    String[] creds = RequestUtil.extractAndDecodeHeader(header);\n} catch (BadCredentialsException e) {\n    log.warn(\"malformed basic auth token: {}\", e.getMessage());\n    response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n}","preventionTips":["Always encode \"username:password\" (with colon) as Base64 for Basic auth.","Don't place JWTs/bearer tokens in a Basic header.","Add client-side tests verifying the decoded token contains exactly one colon."],"tags":["http","basic-auth","authentication","malformed-token"],"backgroundTag":"invalid-argument-format","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}