{"record":{"id":"869e9c78f0f460b5","repo":"apolloconfig/apollo","slug":"empty-username","errorCode":null,"errorMessage":"Empty Username","messagePattern":"Empty Username","errorType":"validation","errorClass":"BadCredentialsException","httpStatus":401,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/spi/ldap/ApolloLdapAuthenticationProvider.java","lineNumber":78,"sourceCode":"    super(authenticator);\n    this.properties = properties;\n  }\n\n  @Override\n  public Authentication authenticate(Authentication authentication) throws AuthenticationException {\n    Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,\n        this.messages.getMessage(\"LdapAuthenticationProvider.onlySupports\",\n            \"Only UsernamePasswordAuthenticationToken is supported\"));\n    UsernamePasswordAuthenticationToken userToken =\n        (UsernamePasswordAuthenticationToken) authentication;\n    String username = userToken.getName();\n    String password = (String) authentication.getCredentials();\n    if (this.logger.isDebugEnabled()) {\n      this.logger.debug(\"Processing authentication request for user: \" + username);\n    }\n\n    if (!StringUtils.hasLength(username)) {\n      throw new BadCredentialsException(\n          this.messages.getMessage(\"LdapAuthenticationProvider.emptyUsername\", \"Empty Username\"));\n    }\n    if (!StringUtils.hasLength(password)) {\n      throw new BadCredentialsException(this.messages\n          .getMessage(\"AbstractLdapAuthenticationProvider.emptyPassword\", \"Empty Password\"));\n    }\n    Assert.notNull(password, \"Null password was supplied in authentication token\");\n    DirContextOperations userData = this.doAuthentication(userToken);\n    String loginId = userData.getStringAttribute(properties.getMapping().getLoginId());\n    UserDetails user = this.userDetailsContextMapper.mapUserFromContext(userData, loginId,\n        this.loadUserAuthorities(userData, loginId, (String) authentication.getCredentials()));\n    return this.createSuccessfulAuthentication(userToken, user);\n  }\n}\n","sourceCodeStart":60,"sourceCodeEnd":93,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/spi/ldap/ApolloLdapAuthenticationProvider.java#L60-L93","documentation":"Thrown by ApolloLdapAuthenticationProvider.authenticate() when the username extracted from the UsernamePasswordAuthenticationToken has zero length (checked via StringUtils.hasLength). This is a BadCredentialsException from Spring Security, mapping to HTTP 401. The message key 'LdapAuthenticationProvider.emptyUsername' is resolved from Spring Security message bundles, defaulting to 'Empty Username'.","triggerScenarios":"An authentication request is submitted to the Apollo portal login (backed by LDAP) where the username field is empty or null. The authenticate() method extracts userToken.getName() and, if it has no length, immediately rejects with BadCredentialsException before attempting any LDAP bind.","commonSituations":"Login form submitted with an empty username field. API client sends a Basic Auth header with no username portion. Automated health-check or monitor hitting the login endpoint without credentials. Frontend validation bypass or bug.","solutions":["Provide a non-empty username in the login form or authentication request.","Add client-side validation to prevent form submission with an empty username.","For API clients, ensure the Authorization header includes a valid username."],"exampleFix":"// before — login submitted with empty username\n// after — frontend validation\nif (!username) { showFieldError('username', 'Username is required'); return; }","handlingStrategy":"try-catch","validationCode":"if (!StringUtils.hasLength(username)) {\n    return ResponseEntity.badRequest().body(\"Username is required\");\n}","typeGuard":"static boolean hasNonEmptyUsername(String username) {\n    return username != null && !username.trim().isEmpty();\n}","tryCatchPattern":"try {\n    authenticationManager.authenticate(\n        new UsernamePasswordAuthenticationToken(username, password));\n} catch (BadCredentialsException e) {\n    if (e.getMessage().contains(\"Empty Username\")) {\n        return ResponseEntity.status(401).body(\"Username is required\");\n    }\n    throw e;\n}","preventionTips":["Add client-side validation to require a non-empty username before login submission.","Reject empty credential fields at the API gateway or controller before reaching the LDAP provider."],"tags":["apollo-portal","ldap","authentication","bad-credentials"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}