{"record":{"id":"5bfc413a164d659c","repo":"apache/pulsar","slug":"blank-token-found","errorCode":null,"errorMessage":"Blank token found","messagePattern":"Blank token found","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java","lineNumber":228,"sourceCode":"            // (https://tools.ietf.org/html/rfc6750#section-2.1). Eg: Authorization: Bearer xxxxxxxxxxxxx\n            String httpHeaderValue = authData.getHttpHeader(HTTP_HEADER_NAME);\n            if (httpHeaderValue == null || !httpHeaderValue.startsWith(HTTP_HEADER_VALUE_PREFIX)) {\n                throw new AuthenticationException(\"Invalid HTTP Authorization header\");\n            }\n\n            // Remove prefix\n            String token = httpHeaderValue.substring(HTTP_HEADER_VALUE_PREFIX.length());\n            return validateToken(token);\n        } else {\n            throw new AuthenticationException(\"No token credentials passed\");\n        }\n    }\n\n    private static String validateToken(final String token) throws AuthenticationException {\n        if (StringUtils.isNotBlank(token)) {\n            return token;\n        } else {\n            throw new AuthenticationException(\"Blank token found\");\n        }\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    private Jws<Claims> authenticateToken(final String token) throws AuthenticationException {\n        try {\n            Jws<Claims> jwt = parser.parseClaimsJws(token);\n\n            if (audienceClaim != null) {\n                Object object = jwt.getBody().get(audienceClaim);\n                if (object == null) {\n                    throw new JwtException(\"Found null Audience in token, for claimed field: \" + audienceClaim);\n                }\n\n                if (object instanceof Collection) {\n                    Collection<String> audiences = (Collection<String>) object;\n                    // audience not contains this broker, throw exception.\n                    if (audiences.stream().noneMatch(audienceInToken -> audienceInToken.equals(audience))) {","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java#L210-L246","documentation":"validateToken() is the first step of token processing in AuthenticationProviderToken; it only checks that the token string is not blank. It throws this AuthenticationException when the extracted token (from command data or after stripping the Bearer prefix) is null, empty, or whitespace-only.","triggerScenarios":"getToken() passes a token to validateToken() that is null, empty, or blank — e.g. an Authorization header of exactly 'Bearer ' with no token, or authParams containing an empty token value.","commonSituations":"Empty token file (token read from file whose contents are blank or only newline); clients with authParams=token: (empty value); header 'Bearer' with trailing whitespace but no token.","solutions":["Provide a non-blank token value in authParams or the Bearer header","If loading the token from a file, verify the file has content and trim whitespace/newlines","Regenerate the token with the pulsar tokens CLI if it was accidentally deleted or emptied"],"exampleFix":"// before\nauthParams=file:///etc/pulsar/token  // file is empty\n// after\nbin/pulsar tokens create --private-key /path/private.pem --subject admin > /etc/pulsar/token\nauthParams=file:///etc/pulsar/token","handlingStrategy":"validation","validationCode":"String token = readTokenFromFile(path);\nif (token == null || token.isBlank()) {\n    throw new IllegalArgumentException(\"Token file \" + path + \" is empty\");\n}","typeGuard":"boolean isUsableToken(String t) { return t != null && !t.isBlank(); }","tryCatchPattern":"try {\n    role = provider.authenticate(authData);\n} catch (AuthenticationException e) {\n    log.warn(\"Blank token supplied; regenerate token via pulsar tokens create\", e);\n}","preventionTips":["Regenerate and verify tokens after any secrets rotation","Trim/validate token files when loading them in scripts","Fail client startup fast if the configured token is blank"],"tags":["jwt","token","validation"],"backgroundTag":"blank-token","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}