{"record":{"id":"5d9f706868b4892f","repo":"paascloud/paascloud-master","slug":"uac10011040","errorCode":"UAC10011040","errorMessage":"UAC10011040","messagePattern":"UAC10011040","errorType":"error_code","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"paascloud-common/paascloud-common-core/src/main/java/com/paascloud/core/utils/RequestUtil.java","lineNumber":129,"sourceCode":"\t\tif (PublicUtil.isEmpty(loginAuthDto)) {\n\t\t\tthrow new BusinessException(ErrorCodeEnum.UAC10011039);\n\t\t}\n\t\treturn loginAuthDto;\n\n\t}\n\n\t/**\n\t * Gets auth header.\n\t *\n\t * @param request the request\n\t *\n\t * @return the auth header\n\t */\n\tpublic static String getAuthHeader(HttpServletRequest request) {\n\n\t\tString authHeader = request.getHeader(HttpHeaders.AUTHORIZATION);\n\t\tif (org.apache.commons.lang.StringUtils.isEmpty(authHeader)) {\n\t\t\tthrow new BusinessException(ErrorCodeEnum.UAC10011040);\n\t\t}\n\t\treturn authHeader;\n\t}\n\n\tpublic static String[] extractAndDecodeHeader(String header) throws IOException {\n\n\t\tbyte[] base64Token = header.substring(6).getBytes(\"UTF-8\");\n\t\tbyte[] decoded;\n\t\ttry {\n\t\t\tdecoded = Base64.decode(base64Token);\n\t\t} catch (IllegalArgumentException e) {\n\t\t\tthrow new BadCredentialsException(\"Failed to decode basic authentication token\");\n\t\t}\n\n\t\tString token = new String(decoded, \"UTF-8\");\n\n\t\tint delim = token.indexOf(GlobalConstant.Symbol.MH);\n","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-common/paascloud-common-core/src/main/java/com/paascloud/core/utils/RequestUtil.java#L111-L147","documentation":"RequestUtil.getAuthHeader throws ErrorCodeEnum.UAC10011040 when the request's Authorization header is absent or empty. It enforces that only requests carrying an Authorization header proceed to token extraction/decoding.","triggerScenarios":"Calling RequestUtil.getAuthHeader(request) on an HttpServletRequest whose Authorization header is null or \"\" — e.g. a direct call that skipped the gateway, a curl without -H Authorization, or a browser request without credentials.","commonSituations":"Clients forgetting to attach the Bearer/Basic header, gateway route misconfiguration stripping headers, CORS preflight or token-refresh requests without the header, or header name case/proxy rewrite issues.","solutions":["Attach a valid Authorization header to the outgoing request (e.g. Authorization: Bearer <token>).","Check proxy/gateway config so the Authorization header is forwarded, not stripped.","In client code, guard: only call APIs requiring auth after obtaining and setting the token."],"exampleFix":"// before\ncurl http://api/user/info\n// after\ncurl -H \"Authorization: Bearer <token>\" http://api/user/info","handlingStrategy":"validation","validationCode":"String authHeader = request.getHeader(HttpHeaders.AUTHORIZATION);\nif (authHeader == null || authHeader.isEmpty()) {\n    throw new AuthenticationException(\"Authorization header is required\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    String header = RequestUtil.getAuthHeader(request);\n} catch (BusinessException e) {\n    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, \"missing Authorization header\");\n}","preventionTips":["Always set the Authorization header in HTTP clients (interceptors/rest templates).","Check gateway/proxy rewrite rules don't strip Authorization.","Return 401 early when the header is missing instead of reaching deep utils."],"tags":["http","authorization","header","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}