{"record":{"id":"446ba87b813dc47b","repo":"apache/pulsar","slug":"no-token-credentials-passed","errorCode":null,"errorMessage":"No token credentials passed","messagePattern":"No token credentials passed","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java","lineNumber":220,"sourceCode":"    }\n\n    public static String getToken(AuthenticationDataSource authData) throws AuthenticationException {\n        if (authData.hasDataFromCommand()) {\n            // Authenticate Pulsar binary connection\n            return validateToken(authData.getCommandData());\n        } else if (authData.hasDataFromHttp()) {\n            // Authentication HTTP request. The format here should be compliant to RFC-6750\n            // (https://tools.ietf.org/html/rfc6750#section-2.1). Eg: Authorization: Bearer xxxxxxxxxxxxx\n            String httpHeaderValue = authData.getHttpHeader(HTTP_HEADER_NAME);\n            if (httpHeaderValue == null || !httpHeaderValue.startsWith(HTTP_HEADER_VALUE_PREFIX)) {\n                throw new AuthenticationException(\"Invalid HTTP Authorization header\");\n            }\n\n            // Remove prefix\n            String token = httpHeaderValue.substring(HTTP_HEADER_VALUE_PREFIX.length());\n            return validateToken(token);\n        } else {\n            throw new AuthenticationException(\"No token credentials passed\");\n        }\n    }\n\n    private static String validateToken(final String token) throws AuthenticationException {\n        if (StringUtils.isNotBlank(token)) {\n            return token;\n        } else {\n            throw new AuthenticationException(\"Blank token found\");\n        }\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    private Jws<Claims> authenticateToken(final String token) throws AuthenticationException {\n        try {\n            Jws<Claims> jwt = parser.parseClaimsJws(token);\n\n            if (audienceClaim != null) {\n                Object object = jwt.getBody().get(audienceClaim);","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java#L202-L238","documentation":"getToken() throws this AuthenticationException when the AuthenticationDataSource contains neither command data nor HTTP data carrying a token — i.e. the client supplied no token credentials at all. Unlike the header-format errors, this means the request simply had no credentials in any recognized channel.","triggerScenarios":"authenticate()/getToken() called with an AuthenticationDataSource that has no command data (hasDataFromCommand() false) and no HTTP data (hasDataFromHttp() false), e.g. empty or unset auth data.","commonSituations":"Client configured with the token auth plugin but no token value supplied (empty authParams); a proxy forwarding an authenticated connection but dropping the auth data; protocol-level auth not attached on the initial connect command.","solutions":["Configure the client's authParams with the token (e.g. authParams=token:eyJ... or authParams=file:///path/token)","Verify the client's authentication plugin is set to 'token' and the broker lists AuthenticationProviderToken in authProviders","Check the connect command actually carries auth data before authentication is attempted"],"exampleFix":"# before\nauthPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken\n# authParams missing\n// after\nauthPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken\nauthParams=eyJhbGciOiJIUzI1NiJ9...","handlingStrategy":"validation","validationCode":"if (!authData.hasDataFromCommand() && !authData.hasDataFromHttp()) {\n    throw new AuthenticationException(\"No token credentials supplied\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    role = provider.authenticate(authData);\n} catch (AuthenticationException e) {\n    log.warn(\"No token credentials passed; check client authParams\", e);\n}","preventionTips":["Set authParams with a non-empty token on every client","Verify the connect command carries authentication data","Check configuration template ships a real token path or value"],"tags":["jwt","token","authentication"],"backgroundTag":"missing-auth-credentials","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}