{"record":{"id":"4d28d868d3b19555","repo":"alibaba/nacos","slug":"username-is-blank","errorCode":null,"errorMessage":"username is blank","messagePattern":"username is blank","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/users/AbstractCachedUserService.java","lineNumber":80,"sourceCode":"    \n    /**\n     * Reject reserved system usernames from being created or deleted.\n     *\n     * @param username the username to check\n     */\n    protected void rejectReservedUsername(String username) {\n        if (AuthConstants.ANONYMOUS_USER.equals(username)) {\n            throw new IllegalArgumentException(\n                \"username '\" + AuthConstants.ANONYMOUS_USER + \"' is reserved by the system\");\n        }\n    }\n    \n    /**\n     * [ISSUE #13625] check username and password is blank.\n     */\n    protected void validateUserCredentials(String username, String password) {\n        if (StringUtils.isBlank(username)) {\n            throw new IllegalArgumentException(\"username is blank\");\n        }\n        rejectReservedUsername(username);\n        if (StringUtils.isBlank(password)) {\n            throw new IllegalArgumentException(\"password is blank\");\n        }\n    }\n}\n","sourceCodeStart":62,"sourceCodeEnd":88,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/users/AbstractCachedUserService.java#L62-L88","documentation":"validateUserCredentials() is the guard invoked at the start of createUser(); a blank/null username is rejected before any remote call is made. StringUtils.isBlank treats empty string and whitespace-only as blank, so leading/trailing spaces alone also fail.","triggerScenarios":"Calling createUser(username, password, encode) with an empty or whitespace-only username — typically from a form field that was not required-validated on the client, or a null passed by an API client.","commonSituations":"Frontend missing a required-field check; API client sending null username; copy-paste introducing whitespace; automated script with an empty row.","solutions":["Validate the username is non-blank on the client before submitting.","Trim the input and reject empty values in your service layer.","Return a clear 400 to the caller instead of letting the plugin throw."],"exampleFix":"// before\nuserService.createUser(username, password, true); // username == \"\" -> IllegalArgumentException\n\n// after\nif (username == null || username.trim().isEmpty()) {\n    return Result.failure(400, \"username is required\");\n}\nuserService.createUser(username.trim(), password, true);","handlingStrategy":"validation","validationCode":"import com.alibaba.nacos.common.utils.StringUtils;\n\nif (StringUtils.isBlank(username)) {\n    throw new IllegalArgumentException(\"username is blank\");\n}\nString clean = username.trim();\nif (clean.isEmpty()) {\n    throw new IllegalArgumentException(\"username is blank after trim\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    userService.createUser(username, password, false);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"username is blank\")) {\n        return Result.failure(400, \"username is required\");\n    }\n    throw e;\n}","preventionTips":["Make the username a required field in the UI/API contract.","Trim and reject empty input in your service layer.","Validate before calling the plugin API.","Return a clean 400 to clients."],"tags":["auth","user-management","validation","input"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}