{"record":{"id":"9b8cd7f2a6bced66","repo":"apache/pulsar","slug":"failed-to-get-clientid-from-request","errorCode":null,"errorMessage":"Failed to get clientId from request","messagePattern":"Failed to get clientId from request","errorType":"http","errorClass":"RestException","httpStatus":401,"severity":"error","filePath":"pulsar-websocket/src/main/java/org/apache/pulsar/websocket/admin/WebSocketWebResource.java","lineNumber":86,"sourceCode":"    @SuppressWarnings(\"deprecation\")\n    public String clientAppId() {\n        if (isBlank(clientId)) {\n            try {\n                String authMethodName = httpRequest.getHeader(AuthenticationFilter.PULSAR_AUTH_METHOD_NAME);\n                if (authMethodName != null\n                    && service().getAuthenticationService().getAuthenticationProvider(authMethodName) != null) {\n                    authenticationDataSource = service().getAuthenticationService()\n                            .getAuthenticationProvider(authMethodName)\n                            .newHttpAuthState(httpRequest).getAuthDataSource();\n                    clientId = service().getAuthenticationService().authenticateHttpRequest(\n                            httpRequest, authenticationDataSource);\n                } else {\n                    clientId = service().getAuthenticationService().authenticateHttpRequest(httpRequest);\n                    authenticationDataSource = new AuthenticationDataHttps(httpRequest);\n                }\n            } catch (AuthenticationException e) {\n                if (service().getConfig().isAuthenticationEnabled()) {\n                    throw new RestException(Status.UNAUTHORIZED, \"Failed to get clientId from request\");\n                }\n            }\n\n            if (isBlank(clientId) && service().getConfig().isAuthenticationEnabled()) {\n                throw new RestException(Status.UNAUTHORIZED, \"Failed to get auth data from the request\");\n            }\n        }\n        return clientId;\n    }\n\n    public AuthenticationDataSource authData() throws AuthenticationException {\n        return authenticationDataSource;\n    }\n\n    /**\n     * Checks whether the user has Pulsar Super-User access to the system.\n     *\n     * @throws RestException","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-websocket/src/main/java/org/apache/pulsar/websocket/admin/WebSocketWebResource.java#L68-L104","documentation":"WebSocketWebResource.clientAppId authenticates the HTTP request; if AuthenticationService.authenticateHttpRequest throws AuthenticationException and authentication is enabled, it returns HTTP 401 'Failed to get clientId from request'. This means the request carried credentials that could not be validated, so the calling role cannot be determined.","triggerScenarios":"Admin REST call against the websocket proxy with an invalid/expired/malformed auth token or cookie while authenticationEnabled=true; the Authorization header fails the configured authentication provider.","commonSituations":"Expired JWT; token signed by a key the proxy doesn't trust; missing/wrong Authorization header scheme (e.g. 'Basic' vs 'Bearer'); proxy configured with a different auth provider than the client library.","solutions":["Refresh the token/credentials and resend with a correct 'Authorization: Bearer <token>' header","Confirm the proxy's authenticationProviders and token signing key match your client's credentials","Check for clock skew causing premature JWT expiry validation failures","If auth is intentionally off, verify authenticationEnabled=false is actually applied to the proxy config"],"exampleFix":"// before\ncurl http://proxy:8080/admin/v2/websocket/stats/my-topic\n// after\ncurl -H \"Authorization: Bearer $TOKEN\" http://proxy:8080/admin/v2/websocket/stats/my-topic","handlingStrategy":"try-catch","validationCode":"// before calling: ensure a non-empty, syntactically valid credential is attached\nif (token == null || token.isBlank()) { throw new IllegalStateException(\"auth token missing; will get 401\"); }","typeGuard":"boolean hasBearerAuth(HttpRequest req) { String h = req.getHeader(\"Authorization\"); return h != null && h.startsWith(\"Bearer \") && h.length() > 7; }","tryCatchPattern":"try { return clientAppId(); } catch (WebApplicationException e) { if (e.getResponse().getStatus() == 401 && e.getMessage().contains(\"clientId\")) { refreshToken(); return clientAppId(); } throw e; }","preventionTips":["Refresh tokens before expiry; handle 401 with a re-auth retry","Match the proxy's configured authenticationProviders to your credential type","Check signing keys and clock skew in JWT deployments","Verify gateways/LBs preserve the Authorization header"],"tags":["rest","authentication","unauthorized"],"backgroundTag":"authentication-failed","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}