{"record":{"id":"316b7b8ffa9738a8","repo":"paascloud/paascloud-master","slug":"client","errorCode":null,"errorMessage":"请求头中无client信息","messagePattern":"请求头中无client信息","errorType":"http","errorClass":"UnapprovedClientAuthenticationException","httpStatus":401,"severity":"error","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/security/PcAuthenticationSuccessHandler.java","lineNumber":56,"sourceCode":"\t@Resource\n\tprivate ClientDetailsService clientDetailsService;\n\t@Resource\n\tprivate UacUserService uacUserService;\n\t@Resource\n\tprivate AuthorizationServerTokenServices authorizationServerTokenServices;\n\n\tprivate static final String BEARER_TOKEN_TYPE = \"Basic \";\n\n\t@Override\n\tpublic void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,\n\t                                    Authentication authentication) throws IOException, ServletException {\n\n\t\tlogger.info(\"登录成功\");\n\n\t\tString header = request.getHeader(HttpHeaders.AUTHORIZATION);\n\n\t\tif (header == null || !header.startsWith(BEARER_TOKEN_TYPE)) {\n\t\t\tthrow new UnapprovedClientAuthenticationException(\"请求头中无client信息\");\n\t\t}\n\n\t\tString[] tokens = RequestUtil.extractAndDecodeHeader(header);\n\t\tassert tokens.length == 2;\n\n\t\tString clientId = tokens[0];\n\t\tString clientSecret = tokens[1];\n\n\t\tClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId);\n\n\t\tif (clientDetails == null) {\n\t\t\tthrow new UnapprovedClientAuthenticationException(\"clientId对应的配置信息不存在:\" + clientId);\n\t\t} else if (!StringUtils.equals(clientDetails.getClientSecret(), clientSecret)) {\n\t\t\tthrow new UnapprovedClientAuthenticationException(\"clientSecret不匹配:\" + clientId);\n\t\t}\n\n\t\tTokenRequest tokenRequest = new TokenRequest(MapUtils.EMPTY_MAP, clientId, clientDetails.getScope(), \"custom\");\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/security/PcAuthenticationSuccessHandler.java#L38-L74","documentation":"PcAuthenticationSuccessHandler.onAuthenticationSuccess throws UnapprovedClientAuthenticationException(\"请求头中无client信息\") when the Authorization header is missing or does not start with the Bearer token type. After successful form login, this handler expects the caller's Basic-style Bearer client credentials (base64 clientId:clientSecret) in the Authorization header to perform an OAuth2 token exchange; without it it cannot identify the OAuth2 client.","triggerScenarios":"POSTing login credentials without an Authorization header, or sending an Authorization header not prefixed with the BEARER_TOKEN_TYPE constant (e.g. plain token, Basic instead of the expected scheme).","commonSituations":"Frontend clients calling the login endpoint directly without attaching the client credentials header; gateway stripping the Authorization header; developers using curl/Postman without the header configured; confusion between Bearer and Basic schemes after framework migration.","solutions":["Send the Authorization header with the expected BEARER prefix and base64(clientId:clientSecret) value on every login request","Verify any gateway/proxy (Zuul/Nginx) is not stripping the Authorization header","Confirm the exact token type constant expected (BEARER_TOKEN_TYPE) and match the case/prefix","If the client has no OAuth2 credentials, register a client in the uac_oauth_client_details table and use its clientId/clientSecret"],"exampleFix":"// before\ncurl -X POST http://uac/login -d 'username=u&password=p'\n// after\ncurl -X POST http://uac/login -H 'Authorization: Basic Y2xpZW50SWQ6Y2xpZW50U2VjcmV0' -d 'username=u&password=p'","handlingStrategy":"validation","validationCode":"String header = request.getHeader(HttpHeaders.AUTHORIZATION);\nboolean ok = header != null && header.startsWith(\"Basic \");\nif (!ok) { /* attach client credentials before calling login */ }","typeGuard":null,"tryCatchPattern":"try { return authClient.login(user, pwd); } catch (UnapprovedClientAuthenticationException e) { log.warn(\"missing/invalid client header: {}\", e.getMessage()); throw new ClientAuthException(e); }","preventionTips":["Centralize the Authorization-header construction in one HTTP interceptor","Base64-encode clientId:clientSecret exactly as the server expects and reuse the constant","Check gateway/Nginx configs for header stripping (underscores_in_headers, proxy_set_header Authorization)","Document the required header in the login API contract"],"tags":["oauth2","authentication","http-header","security"],"backgroundTag":"missing-credentials","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}