{"record":{"id":"4bb2e02445359373","repo":"apache/pulsar","slug":"invalid-http-authorization-header","errorCode":null,"errorMessage":"Invalid HTTP Authorization header","messagePattern":"Invalid HTTP Authorization header","errorType":"http","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java","lineNumber":184,"sourceCode":"        try {\n            // Get Token\n            token = getToken(authData);\n        } catch (AuthenticationException exception) {\n            incrementFailureMetric(ErrorCode.INVALID_AUTH_DATA);\n            throw exception;\n        }\n        // Parse Token by validating\n        String role = getPrincipal(authenticateToken(token));\n        authenticationMetricsToken.recordSuccess();\n        return role;\n    }\n\n    @Override\n    public boolean authenticateHttpRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {\n        HttpServletRequestWrapper wrappedRequest = new HttpServletRequestWrapper(request);\n        String httpHeaderValue = wrappedRequest.getHeader(HTTP_HEADER_NAME);\n        if (httpHeaderValue == null || !httpHeaderValue.startsWith(HTTP_HEADER_VALUE_PREFIX)) {\n            throw new AuthenticationException(\"Invalid HTTP Authorization header\");\n        }\n        AuthenticationDataSource authenticationDataSource = new AuthenticationDataHttps(wrappedRequest);\n        String role = authenticate(authenticationDataSource);\n        request.setAttribute(AuthenticatedRoleAttributeName, role);\n        request.setAttribute(AuthenticatedDataAttributeName, authenticationDataSource);\n        return true;\n    }\n\n    @Override\n    public AuthenticationState newAuthState(AuthData authData, SocketAddress remoteAddress, SSLSession sslSession)\n            throws AuthenticationException {\n        return new TokenAuthenticationState(this, authData, remoteAddress, sslSession);\n    }\n\n    @Override\n    public AuthenticationState newHttpAuthState(HttpServletRequest request) throws AuthenticationException {\n        return new TokenAuthenticationState(this, new HttpServletRequestWrapper(request));\n    }","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java#L166-L202","documentation":"AuthenticationProviderToken.authenticateHttpRequest() validates HTTP requests for token auth. It requires an Authorization header present and starting with the expected prefix (\"Bearer \"). It throws this AuthenticationException when the header is missing entirely or has a malformed scheme (e.g. missing 'Bearer ' prefix, wrong case handled elsewhere, or 'Basic' auth sent instead).","triggerScenarios":"An HTTP request hitting the token-authenticated web endpoint with: no Authorization header; header not starting with 'Bearer '; or a non-Bearer scheme like Basic/Negotiate.","commonSituations":"Curl/API calls that omit the -H 'Authorization: Bearer <token>' header; clients using HTTP Basic auth instead of Bearer; reverse proxies stripping the Authorization header; case errors like 'bearer' depending on prefix matching.","solutions":["Send the header as 'Authorization: Bearer <token>' with the exact prefix","Check that proxies/gateways are not stripping or rewriting the Authorization header","Confirm the endpoint's configured auth provider expects token (Bearer) auth and you're not mixing auth methods"],"exampleFix":"# before\ncurl -H \"Authorization: eyJhbGciOi...\" https://broker:8080/admin/v2/clusters\n// after\ncurl -H \"Authorization: Bearer eyJhbGciOi...\" https://broker:8080/admin/v2/clusters","handlingStrategy":"validation","validationCode":"String auth = request.getHeader(\"Authorization\");\nboolean valid = auth != null && auth.startsWith(\"Bearer \");\nif (!valid) {\n    throw new AuthenticationException(\"Invalid HTTP Authorization header\");\n}","typeGuard":"boolean isBearerHeader(String h) { return h != null && h.startsWith(\"Bearer \"); }","tryCatchPattern":"try {\n    provider.authenticateHttpRequest(request, response);\n} catch (Exception e) {\n    response.sendError(401, \"Missing or malformed Authorization: Bearer header\");\n}","preventionTips":["Always send 'Authorization: Bearer <token>' on token-secured endpoints","Check proxy/ingress configs don't strip Authorization headers","Use client SDK auth plugins instead of hand-built headers"],"tags":["http","jwt","authentication"],"backgroundTag":"invalid-authorization-header","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}