{"record":{"id":"36d2a4c10c692dbe","repo":"apache/cassandra","slug":"you-have-not-logged-in","errorCode":null,"errorMessage":"You have not logged in","messagePattern":"You have not logged in","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":604,"sourceCode":"        if (SchemaConstants.isLocalSystemKeyspace(keyspace))\n            throw new UnauthorizedException(keyspace + \" keyspace is not user-modifiable.\");\n\n        if (SchemaConstants.isReplicatedSystemKeyspace(keyspace))\n        {\n            // allow users with sufficient privileges to alter replication params of replicated system keyspaces\n            if (perm == Permission.ALTER && resource.isKeyspaceLevel())\n                return;\n\n            // prevent all other modifications of replicated system keyspaces\n            throw new UnauthorizedException(String.format(\"Cannot %s %s\", perm, resource));\n        }\n    }\n\n    public void validateLogin()\n    {\n        if (user == null)\n        {\n            throw new UnauthorizedException(\"You have not logged in\");\n        }\n        else if (!user.hasLocalAccess())\n        {\n            throw new UnauthorizedException(String.format(\"You do not have access to this datacenter (%s)\", Datacenters.thisDatacenter()));\n        }\n        else\n        {\n            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))\n                throw new UnauthorizedException(\"You do not have access from this IP \" + remoteAddress.getHostString());\n        }\n    }\n\n    public void ensureNotAnonymous()\n    {\n        validateLogin();\n        if (user.isAnonymous())\n            throw new UnauthorizedException(\"You have to be logged in and not anonymous to perform this request\");\n    }","sourceCodeStart":586,"sourceCodeEnd":622,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L586-L622","documentation":"UnauthorizedException thrown by ClientState.validateLogin() when the client state has no authenticated user, i.e. no LOGIN/execution happened after authenticating, or authentication was skipped. Cassandra requires a logged-in AuthenticatedUser before authorizing statements when auth is enabled.","triggerScenarios":"Sending statements on a connection without a preceding successful AUTHENTICATE/login handshake; calling ClientState.validateLogin() (directly or via ensurePermission/authorize/hasTablePermission) while user == null; using a driver connection created without credentials against an auth-enabled cluster.","commonSituations":"Driver misconfiguration missing credentials (no auth provider) against a cluster with authenticator: PasswordAuthenticator; custom clients speaking CQL binary protocol that skip the STARTUP/AUTHENTICATE exchange; sessions created before login in embedded tooling.","solutions":["Log in before executing statements: provide credentials in the driver's auth provider configuration.","Verify cassandra.yaml authenticator is consistent with your client setup (Authenticator vs AllowAllAuthenticator).","For protocol-level clients, complete the AUTHENTICATE/AUTH_RESPONSE message exchange before QUERY messages.","If authentication is intentionally not used, set authenticator and authorizer to AllowAll* in cassandra.yaml and restart."],"exampleFix":"// before\nCqlSession session = CqlSession.builder().addContactPoint(addr).build();\n// after\nCqlSession session = CqlSession.builder().addContactPoint(addr)\n    .withAuthCredentials(\"user\", \"password\").build();","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    session.execute(query);\n} catch (com.datastax.oss.driver.api.core.servererrors.UnauthorizedException e) {\n    if (e.getMessage().contains(\"not logged in\")) {\n        session = loginAndReconnect(credentials); // re-authenticate then retry\n    } else throw e;\n}","preventionTips":["Always configure driver credentials when authenticator is not AllowAll.","Complete the CQL auth handshake before sending queries in raw-protocol clients.","Keep server authenticator and client auth config in sync via infrastructure-as-code."],"tags":["authentication","session","cql"],"backgroundTag":"authentication-required","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}