{"record":{"id":"359e06cc03ea735e","repo":"apolloconfig/apollo","slug":"empty-password","errorCode":null,"errorMessage":"Empty Password","messagePattern":"Empty Password","errorType":"validation","errorClass":"BadCredentialsException","httpStatus":401,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/spi/ldap/ApolloLdapAuthenticationProvider.java","lineNumber":82,"sourceCode":"  @Override\n  public Authentication authenticate(Authentication authentication) throws AuthenticationException {\n    Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,\n        this.messages.getMessage(\"LdapAuthenticationProvider.onlySupports\",\n            \"Only UsernamePasswordAuthenticationToken is supported\"));\n    UsernamePasswordAuthenticationToken userToken =\n        (UsernamePasswordAuthenticationToken) authentication;\n    String username = userToken.getName();\n    String password = (String) authentication.getCredentials();\n    if (this.logger.isDebugEnabled()) {\n      this.logger.debug(\"Processing authentication request for user: \" + username);\n    }\n\n    if (!StringUtils.hasLength(username)) {\n      throw new BadCredentialsException(\n          this.messages.getMessage(\"LdapAuthenticationProvider.emptyUsername\", \"Empty Username\"));\n    }\n    if (!StringUtils.hasLength(password)) {\n      throw new BadCredentialsException(this.messages\n          .getMessage(\"AbstractLdapAuthenticationProvider.emptyPassword\", \"Empty Password\"));\n    }\n    Assert.notNull(password, \"Null password was supplied in authentication token\");\n    DirContextOperations userData = this.doAuthentication(userToken);\n    String loginId = userData.getStringAttribute(properties.getMapping().getLoginId());\n    UserDetails user = this.userDetailsContextMapper.mapUserFromContext(userData, loginId,\n        this.loadUserAuthorities(userData, loginId, (String) authentication.getCredentials()));\n    return this.createSuccessfulAuthentication(userToken, user);\n  }\n}\n","sourceCodeStart":64,"sourceCodeEnd":93,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/spi/ldap/ApolloLdapAuthenticationProvider.java#L64-L93","documentation":"Thrown by ApolloLdapAuthenticationProvider.authenticate() when the password (credentials) extracted from the authentication token has zero length. Checked via StringUtils.hasLength, immediately after the username check. BadCredentialsException → HTTP 401. Message key 'AbstractLdapAuthenticationProvider.emptyPassword', default 'Empty Password'.","triggerScenarios":"An authentication request to the LDAP-backed Apollo portal login where the password is empty or null. The credential is extracted as (String) authentication.getCredentials(); if it has no length, BadCredentialsException is thrown before any LDAP bind is attempted.","commonSituations":"Login form submitted with an empty password field. API client omits or sends empty password in Basic Auth. User mistypes and submits without a password. Frontend password field validation is missing or bypassed.","solutions":["Provide a non-empty password in the login form or authentication request.","Add client-side validation to require a non-empty password before submission.","For API clients, ensure the password portion of the Authorization header is populated."],"exampleFix":"// before — login submitted with empty password\n// after — frontend validation\nif (!password) { showFieldError('password', 'Password is required'); return; }","handlingStrategy":"try-catch","validationCode":"if (!StringUtils.hasLength(password)) {\n    return ResponseEntity.badRequest().body(\"Password is required\");\n}","typeGuard":"static boolean hasNonEmptyPassword(String password) {\n    return password != null && !password.isEmpty();\n}","tryCatchPattern":"try {\n    authenticationManager.authenticate(\n        new UsernamePasswordAuthenticationToken(username, password));\n} catch (BadCredentialsException e) {\n    if (e.getMessage().contains(\"Empty Password\")) {\n        return ResponseEntity.status(401).body(\"Password is required\");\n    }\n    throw e;\n}","preventionTips":["Add client-side validation to require a non-empty password before login submission.","Reject empty credential fields at the API gateway or controller before reaching the LDAP provider."],"tags":["apollo-portal","ldap","authentication","bad-credentials"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}