{"record":{"id":"49acb7db8e7a2f06","repo":"apache/cassandra","slug":"password-must-not-be-null","errorCode":null,"errorMessage":"Password must not be null","messagePattern":"Password must not be null","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/PasswordAuthenticator.java","lineNumber":353,"sourceCode":"            byte[] pass = null;\n            int end = bytes.length;\n            for (int i = bytes.length - 1; i >= 0; i--)\n            {\n                if (bytes[i] == NUL)\n                {\n                    if (pass == null)\n                        pass = Arrays.copyOfRange(bytes, i + 1, end);\n                    else if (user == null)\n                        user = Arrays.copyOfRange(bytes, i + 1, end);\n                    else\n                        throw new AuthenticationException(\"Credential format error: username or password is empty or contains NUL(\\\\0) character\");\n\n                    end = i;\n                }\n            }\n\n            if (pass == null || pass.length == 0)\n                throw new AuthenticationException(\"Password must not be null\");\n            if (user == null || user.length == 0)\n                throw new AuthenticationException(\"Authentication ID must not be null\");\n\n            username = new String(user, StandardCharsets.UTF_8);\n            password = new String(pass, StandardCharsets.UTF_8);\n        }\n    }\n\n    public static class CredentialsCache extends AuthCache<String, String> implements CredentialsCacheMBean\n    {\n        private CredentialsCache(PasswordAuthenticator authenticator)\n        {\n            super(CACHE_NAME,\n                  DatabaseDescriptor::setCredentialsValidity,\n                  DatabaseDescriptor::getCredentialsValidity,\n                  DatabaseDescriptor::setCredentialsUpdateInterval,\n                  DatabaseDescriptor::getCredentialsUpdateInterval,\n                  DatabaseDescriptor::setCredentialsCacheMaxEntries,","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordAuthenticator.java#L335-L371","documentation":"After splitting the SASL PLAIN token on NULs, decodeCredentials() verifies that a non-empty password segment was extracted. A missing or zero-length password cannot be used for authentication, so AuthenticationException is thrown instead of attempting a lookup.","triggerScenarios":"AuthResponse token where the final segment after the second NUL is absent or empty (token ends with a NUL), e.g. client sends only authcid without a password.","commonSituations":"Drivers or scripts that build the PLAIN message with an unset password variable; users configuring empty passwords; tooling sending truncated credentials.","solutions":["Supply a non-empty password in the SASL PLAIN response (even if the account legitimately uses empty password, set it explicitly)","Fix client code so the password variable is populated before building the token","Verify cqlsh/driver credentials (e.g. -u/-p flags or credentials provider) are not blank"],"exampleFix":"// before\nString token = authzid + \"\\0\" + user + \"\\0\" + password; // password == \"\"\n// after\nif (password == null || password.isEmpty()) throw new IllegalArgumentException(\"password required\");\nString token = authzid + \"\\0\" + user + \"\\0\" + password;","handlingStrategy":"validation","validationCode":"if (password == null || password.isEmpty()) throw new IllegalArgumentException(\"password required for SASL PLAIN\");","typeGuard":"boolean hasPassword(Credentials c) { return c != null && c.password != null && !c.password.isEmpty(); }","tryCatchPattern":"try { authenticate(user, pass); } catch (AuthenticationException e) { promptForCredentials(); }","preventionTips":["Never allow empty password strings in credential configs","Fail fast in client startup when required credentials are blank","Validate env vars/config used to feed credentials before connecting"],"tags":["authentication","sasl","missing-credentials"],"backgroundTag":"missing-credentials","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}