{"record":{"id":"792356d084565410","repo":"apache/dubbo","slug":"invalid-url-password-without-username","errorCode":null,"errorMessage":"Invalid url, password without username!","messagePattern":"Invalid url, password without username!","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"dubbo-common/src/main/java/org/apache/dubbo/common/URL.java","lineNumber":195,"sourceCode":"\n    public URL(String protocol, String username, String password, String host, int port, String path) {\n        this(protocol, username, password, host, port, path, (Map<String, String>) null);\n    }\n\n    public URL(String protocol, String username, String password, String host, int port, String path, String... pairs) {\n        this(protocol, username, password, host, port, path, CollectionUtils.toStringMap(pairs));\n    }\n\n    public URL(\n            String protocol,\n            String username,\n            String password,\n            String host,\n            int port,\n            String path,\n            Map<String, String> parameters) {\n        if (StringUtils.isEmpty(username) && StringUtils.isNotEmpty(password)) {\n            throw new IllegalArgumentException(\"Invalid url, password without username!\");\n        }\n\n        this.urlAddress = new PathURLAddress(protocol, username, password, path, host, port);\n        this.urlParam = URLParam.parse(parameters);\n        this.attributes = null;\n    }\n\n    protected URL(\n            String protocol,\n            String username,\n            String password,\n            String host,\n            int port,\n            String path,\n            Map<String, String> parameters,\n            boolean modifiable) {\n        if (StringUtils.isEmpty(username) && StringUtils.isNotEmpty(password)) {\n            throw new IllegalArgumentException(\"Invalid url, password without username!\");","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/apache/dubbo/blob/3a3043227f5571d25eb2889de5bca22f2914843b/dubbo-common/src/main/java/org/apache/dubbo/common/URL.java#L177-L213","documentation":"Thrown by the public URL constructor when a password is supplied without a username (username empty, password non-empty). Dubbo URL semantics treat credentials as a pair, so a lone password is rejected as malformed at construction time with an IllegalArgumentException.","triggerScenarios":"Constructing a new URL(...) directly with a non-empty password and an empty/null username; parsing/transforming a connection string where the userinfo lost its username but kept the password (e.g. \":secret@host\"); programmatically building a URL and setting only setPassword.","commonSituations":"Registry/broker URLs with credentials where the username was accidentally dropped during templating or config interpolation; misformatted credentials in properties/yaml (e.g. password set, username left blank); migrating a URL string and stripping the userinfo incorrectly.","solutions":["Supply a non-empty username whenever a password is set, or clear both credentials if authentication is not needed.","Fix the source URL string so the userinfo is either 'user:pass@', 'user@', or absent (never ':pass@').","Validate credentials in config loading before constructing the URL and fail with a clear config error."],"exampleFix":"// before\nnew URL(\"nacos\", \"\", \"secret\", \"host\", 8848, path, params); // throws\n\n// after\nnew URL(\"nacos\", \"appUser\", \"secret\", \"host\", 8848, path, params);","handlingStrategy":"validation","validationCode":"// Validate credential pairing before constructing the URL\nif ((username == null || username.isEmpty()) && password != null && !password.isEmpty()) {\n    throw new IllegalArgumentException(\"refusing to build URL: password without username\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always source username and password from one credential pair.","Normalize userinfo in config so a lone password never reaches URL construction.","Unit-test URL construction with the real config values."],"tags":["url","config","validation","credentials","userinfo"],"backgroundTag":null,"analyzedSha":"3a3043227f5571d25eb2889de5bca22f2914843b","analyzedAt":"2026-08-14T00:43:19.853Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}