{"record":{"id":"aa507af93e2e7453","repo":"alibaba/nacos","slug":"password-is-blank","errorCode":null,"errorMessage":"password is blank","messagePattern":"password is blank","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/users/AbstractCachedUserService.java","lineNumber":84,"sourceCode":"     * @param username the username to check\n     */\n    protected void rejectReservedUsername(String username) {\n        if (AuthConstants.ANONYMOUS_USER.equals(username)) {\n            throw new IllegalArgumentException(\n                \"username '\" + AuthConstants.ANONYMOUS_USER + \"' is reserved by the system\");\n        }\n    }\n    \n    /**\n     * [ISSUE #13625] check username and password is blank.\n     */\n    protected void validateUserCredentials(String username, String password) {\n        if (StringUtils.isBlank(username)) {\n            throw new IllegalArgumentException(\"username is blank\");\n        }\n        rejectReservedUsername(username);\n        if (StringUtils.isBlank(password)) {\n            throw new IllegalArgumentException(\"password is blank\");\n        }\n    }\n}\n","sourceCodeStart":66,"sourceCodeEnd":88,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/users/AbstractCachedUserService.java#L66-L88","documentation":"Second clause of validateUserCredentials(): after the username passes, a blank password is rejected before any remote call. A user cannot be created without a non-empty password.","triggerScenarios":"Calling createUser with a valid username but an empty or whitespace-only password.","commonSituations":"Password field left empty in a create-user form; API client sending null/empty password; password generator returning an empty value on error.","solutions":["Require a non-empty password in the client/UI before calling createUser.","Enforce a minimum password length in your own validation layer.","Surface a clear validation error instead of relying on the plugin exception."],"exampleFix":"// before\nuserService.createUser(username, \"\", true); // -> IllegalArgumentException\n\n// after\nif (password == null || password.trim().isEmpty()) {\n    return Result.failure(400, \"password is required\");\n}\nuserService.createUser(username, password, true);","handlingStrategy":"validation","validationCode":"import com.alibaba.nacos.common.utils.StringUtils;\n\nif (StringUtils.isBlank(password)) {\n    throw new IllegalArgumentException(\"password is blank\");\n}\nif (password.trim().length() < 8) {\n    throw new IllegalArgumentException(\"password too short\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    userService.createUser(username, password, false);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"password is blank\")) {\n        return Result.failure(400, \"password is required\");\n    }\n    throw e;\n}","preventionTips":["Require a non-empty password in the create-user form/API.","Enforce a minimum password length in your validation layer.","Validate before calling the plugin API.","Never default the password to an empty string."],"tags":["auth","user-management","validation","input","password"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}