{"record":{"id":"9d1ebd9ee8ef9a61","repo":"apache/pulsar","slug":"unsupported-media-type-or-encoding-format-conte-9d1ebd","errorCode":null,"errorMessage":"Unsupported media type or encoding format: ${contentType}","messagePattern":"Unsupported media type or encoding format: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/ClientCredentialsFlow.java","lineNumber":133,"sourceCode":"                .jcaProvider(jcaProvider)\n                .build();\n    }\n\n    /**\n     * Loads the private key from the given URL.\n     *\n     * @param privateKeyURL\n     * @return\n     * @throws IOException\n     */\n    private static KeyFile loadPrivateKey(String privateKeyURL) throws IOException {\n        try {\n            URLConnection urlConnection = new org.apache.pulsar.client.api.url.URL(privateKeyURL).openConnection();\n            try {\n                String protocol = urlConnection.getURL().getProtocol();\n                String contentType = urlConnection.getContentType();\n                if (\"data\".equals(protocol) && !\"application/json\".equals(contentType)) {\n                    throw new IllegalArgumentException(\n                            \"Unsupported media type or encoding format: \" + urlConnection.getContentType());\n                }\n                KeyFile privateKey;\n                try (Reader r = new InputStreamReader((InputStream) urlConnection.getContent(),\n                        StandardCharsets.UTF_8)) {\n                    privateKey = KeyFile.fromJson(r);\n                }\n                return privateKey;\n            } finally {\n                IOUtils.close(urlConnection);\n            }\n        } catch (URISyntaxException | InstantiationException | IllegalAccessException e) {\n            throw new IOException(\"Invalid privateKey format\", e);\n        }\n    }\n\n    @Override\n    public void initialize() throws PulsarClientException {","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/ClientCredentialsFlow.java#L115-L151","documentation":"ClientCredentialsFlow.loadPrivateKey() opens a URL for the privateKey and, when the protocol is 'data', requires the content type to be application/json. A data: URI with any other content type is rejected with IllegalArgumentException('Unsupported media type or encoding format: ...') because the key file must be JSON (KeyFile.fromJson).","triggerScenarios":"privateKey supplied as a data: URI whose declared media type is not application/json, e.g. data:text/plain;base64,... or data:;base64,...; the URI encoding drops or alters the content type.","commonSituations":"Embedding the OAuth2 key JSON as a data URI in config (common in Kubernetes secrets) with the wrong MIME type; hand-encoding the base64 payload and forgetting ';base64' or the type segment.","solutions":["Use a data URI with explicit JSON type: data:application/json;base64,<base64 of key json>","Decode the key and pass a file:// or data:application/json URI","Verify the URI encodes ';base64' correctly when the payload is base64"],"exampleFix":"// before\nString key = \"data:text/plain;base64,eyJjbGllbnRJZCI6Ii4uLiJ9\";\n// after\nString key = \"data:application/json;base64,eyJjbGllbnRJZCI6Ii4uLi4ifQ==\";","handlingStrategy":"validation","validationCode":"String key = authParams.get(\"privateKey\");\nif (key != null && key.startsWith(\"data:\")) {\n    int semi = key.indexOf(';');\n    String type = key.substring(5, semi > 0 ? semi : key.length());\n    if (!\"application/json\".equals(type)) {\n        throw new IllegalArgumentException(\"data URI privateKey must be application/json, got: \" + type);\n    }\n}","typeGuard":"boolean isJsonDataUri(String uri) {\n    return uri != null && uri.startsWith(\"data:application/json\")\n        && (uri.length() == \"data:application/json\".length()\n            || uri.charAt(\"data:application/json\".length()) == ';' || uri.charAt(\"data:application/json\".length()) == ',');\n}","tryCatchPattern":"try {\n    flow.initialize();\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Unsupported media type\")) {\n        throw new ConfigException(\"Fix privateKey data URI to data:application/json;base64,...\", e);\n    }\n    throw e;\n}","preventionTips":["Always declare application/json in data: URIs for the private key","Base64-encode the key JSON and include the ';base64' marker","Test data URI decoding independently before wiring into the client"],"tags":["oauth2","config","data-uri","content-type"],"backgroundTag":"unsupported-media-type","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}