{"record":{"id":"6f192176559d0fd5","repo":"apolloconfig/apollo","slug":"unsupported-auth-type-s-6f1921","errorCode":null,"errorMessage":"Unsupported auth type: %s","messagePattern":"Unsupported auth type: (.+?)","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ItemController.java","lineNumber":297,"sourceCode":"        || UserIdentityConstants.USER_TOKEN.equals(authType)) {\n      UserInfo loginUser = userInfoHolder.getUser();\n      if (loginUser == null || StringUtils.isBlank(loginUser.getUserId())) {\n        throw new BadRequestException(\"Current user not found\");\n      }\n      return loginUser.getUserId();\n    }\n\n    if (UserIdentityConstants.CONSUMER.equals(authType)) {\n      String operator = StringUtils.isBlank(queryOperator) ? payloadOperator : queryOperator;\n      RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(operator),\n          \"operator should not be null or empty\");\n      if (userService.findByUserId(operator) == null) {\n        throw BadRequestException.userNotExists(operator);\n      }\n      return operator;\n    }\n\n    throw new BadRequestException(\"Unsupported auth type: %s\", authType);\n  }\n\n  private boolean shouldHideConfigToPortalUser(String appId, String env, String clusterName,\n      String namespaceName) {\n    return UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName);\n  }\n\n  private void requireConfigReadForUserToken(String appId, String env, String clusterName,\n      String namespaceName) {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName)) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n  }\n","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ItemController.java#L279-L315","documentation":"Thrown by ItemController.resolveOperator when the authType from UserIdentityContextHolder does not match USER, USER_TOKEN, or CONSUMER. This is the terminal fallthrough — the method has explicit branches for the three known auth types and throws for anything else (e.g. ANONYMOUS or null). Maps to HTTP 400 BadRequestException.","triggerScenarios":"Any item write endpoint where the request reached the controller with an unrecognized or unset authType. This happens when the authentication filter did not populate UserIdentityContextHolder, or set it to ANONYMOUS for a route that requires authenticated access.","commonSituations":"A misconfigured security filter chain allows unauthenticated requests to reach OpenAPI write endpoints. A custom authentication interceptor fails to call UserIdentityContextHolder.setAuthType(). After an Apollo upgrade, a new auth type constant is introduced but resolveOperator is not updated. Local development with auth filters disabled.","solutions":["Ensure the request includes proper authentication and the auth filter sets UserIdentityContextHolder to USER, CONSUMER, or USER_TOKEN.","Check the security filter chain configuration — verify OpenAPI endpoints require authentication and the interceptor populates the auth type.","If a new auth type was introduced, add an explicit branch for it in resolveOperator."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// This error signals a server-side auth pipeline issue — catch and diagnose\ntry {\n    controller.updateItem(appId, env, clusterName, namespaceName, item, false);\n} catch (BadRequestException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Unsupported auth type\")) {\n        logger.error(\"Auth type not recognized. Security filter may be misconfigured.\", e);\n        throw new IllegalStateException(\"Server auth configuration error\", e);\n    }\n    throw e;\n}","preventionTips":["Ensure the authentication filter sets UserIdentityContextHolder to a recognized type before the controller executes.","Add integration tests verifying that all auth paths populate the auth type correctly.","After Apollo upgrades, grep for new auth type constants and update all resolveOperator and permission methods."],"tags":["validation","openapi","item","bad-request","auth-type","configuration","http-400"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}