{"record":{"id":"3d36b80cd5036e89","repo":"apache/pulsar","slug":"invalid-header","errorCode":"INVALID_HEADER","errorMessage":"Authentication token has to be started with \"Basic \"","messagePattern":"Authentication token has to be started with \"Basic \"","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderBasic.java","lineNumber":174,"sourceCode":"        }\n        authenticationMetrics.recordSuccess();\n        return userId;\n    }\n\n    private class AuthParams {\n        private String userId;\n        private String password;\n\n        public AuthParams(AuthenticationDataSource authData) throws AuthenticationException {\n            String authParams;\n            if (authData.hasDataFromCommand()) {\n                authParams = authData.getCommandData();\n            } else if (authData.hasDataFromHttp()) {\n                String rawAuthToken = authData.getHttpHeader(HTTP_HEADER_NAME);\n                // parsing and validation\n                if (StringUtils.isBlank(rawAuthToken) || !rawAuthToken.toUpperCase().startsWith(\"BASIC \")) {\n                    incrementFailureMetric(ErrorCode.INVALID_HEADER);\n                    throw new AuthenticationException(\"Authentication token has to be started with \\\"Basic \\\"\");\n                }\n                String[] splitRawAuthToken = rawAuthToken.split(\" \");\n                if (splitRawAuthToken.length != 2) {\n                    incrementFailureMetric(ErrorCode.INVALID_HEADER);\n                    throw new AuthenticationException(\"Base64 encoded token is not found\");\n                }\n\n                try {\n                    authParams = new String(Base64.getDecoder().decode(splitRawAuthToken[1]));\n                } catch (Exception e) {\n                    incrementFailureMetric(ErrorCode.INVALID_HEADER);\n                    throw new AuthenticationException(\"Base64 decoding is failure: \" + e.getMessage());\n                }\n            } else {\n                incrementFailureMetric(ErrorCode.EMPTY_AUTH_DATA);\n                throw new AuthenticationException(\"Authentication data source does not have data\");\n            }\n","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderBasic.java#L156-L192","documentation":"Header-format guard in the inner AuthParams parser of AuthenticationProviderBasic: the Authorization header value is blank or does not begin with the \"Basic \" scheme prefix, so no Base64 user:password payload can be extracted; a malformed or wrong-scheme Authorization header is the faulty input.","triggerScenarios":"Thrown at pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderBasic.java:174 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Send the header as 'Basic <base64(user:password)>'"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}