{"record":{"id":"4fbdbd45c735f76d","repo":"apache/pulsar","slug":"failed-to-authentication-http-request","errorCode":null,"errorMessage":"Failed to authentication http request","messagePattern":"Failed to authentication http request","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProvider.java","lineNumber":202,"sourceCode":"     * @return Set response, according to passed in request, and return whether we should do following chain.doFilter.\n     * @throws Exception when authentication failed\n     * @deprecated use and implement {@link AuthenticationProvider#authenticateHttpRequestAsync} instead.\n     */\n    @Deprecated\n    default boolean authenticateHttpRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {\n        try {\n            AuthenticationState authenticationState = newHttpAuthState(request);\n            String role = authenticateAsync(authenticationState.getAuthDataSource()).get();\n            request.setAttribute(AuthenticatedRoleAttributeName, role);\n            request.setAttribute(AuthenticatedDataAttributeName, authenticationState.getAuthDataSource());\n            return true;\n        } catch (AuthenticationException e) {\n            throw e;\n        } catch (Exception e) {\n            if (e instanceof ExecutionException && e.getCause() instanceof AuthenticationException) {\n                throw (AuthenticationException) e.getCause();\n            } else {\n                throw new AuthenticationException(\"Failed to authentication http request\");\n            }\n        }\n    }\n}\n","sourceCodeStart":184,"sourceCodeEnd":207,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProvider.java#L184-L207","documentation":"AuthenticationProvider.authenticateHttpRequest wraps synchronous authentication of an HTTP request. AuthenticationException is rethrown as-is, but any other exception (including ExecutionException from the async path whose cause is not an AuthenticationException, NPEs, misconfigured providers) is masked and rethrown as a generic AuthenticationException \"Failed to authentication http request\".","triggerScenarios":"authenticateHttpRequest()/authenticateHttpRequestAsync() encounters a non-auth exception: provider misconfigured, null auth header causing NPE, wrapped ExecutionException from the CompletableFuture, or RuntimeException inside a provider's authenticate().","commonSituations":"Missing authentication provider configuration (e.g. token provider without a secret key); broken interceptors/filters upstream; provider throwing unexpected exceptions on malformed headers.","solutions":["Check broker log for the suppressed cause — enable DEBUG logging on AuthenticationProvider","Fix the provider configuration (e.g. provide the token secret key) or the malformed request header","In custom providers, catch and convert expected failures to AuthenticationException so the real cause surfaces"],"exampleFix":"// before (custom provider)\npublic User authenticate(AuthDataSource ds, String header) {\n    return parse(header.split(\" \")[1]); // NPE on malformed header\n}\n// after\npublic User authenticate(AuthenticationDataSource ds, String header) throws AuthenticationException {\n    if (header == null || !header.startsWith(\"Bearer \")) throw new AuthenticationException(\"missing token\");\n    try { return parse(header.substring(7)); }\n    catch (Exception e) { throw new AuthenticationException(\"bad token\", e); }\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    String role = provider.authenticateHttpRequest(request);\n} catch (AuthenticationException e) {\n    respond(Response.status(UNAUTHORIZED).build());\n}","preventionTips":["Enable DEBUG logging to see the masked underlying cause","Configure providers fully (keys, data sources) before enabling HTTP auth","In custom providers, throw AuthenticationException for expected failures"],"tags":["authentication","http","exception-wrapping"],"backgroundTag":"http-auth-failed","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}