{"record":{"id":"af19631595310f8d","repo":"signalapp/Signal-Server","slug":"unsupported-authorization-method","errorCode":null,"errorMessage":"Unsupported authorization method: ","messagePattern":"Unsupported authorization method: ","errorType":"http","errorClass":"InvalidAuthorizationHeaderException","httpStatus":401,"severity":"error","filePath":"service/src/main/java/org/whispersystems/textsecuregcm/auth/BasicAuthorizationHeader.java","lineNumber":38,"sourceCode":"    this.password = password;\n  }\n\n  public static BasicAuthorizationHeader fromString(final String header) throws InvalidAuthorizationHeaderException {\n    try {\n      if (StringUtils.isBlank(header)) {\n        throw new InvalidAuthorizationHeaderException(\"Blank header\");\n      }\n\n      final int spaceIndex = header.indexOf(' ');\n\n      if (spaceIndex == -1) {\n        throw new InvalidAuthorizationHeaderException(\"Invalid authorization header: \" + header);\n      }\n\n      final String authorizationType = header.substring(0, spaceIndex);\n\n      if (!\"Basic\".equals(authorizationType)) {\n        throw new InvalidAuthorizationHeaderException(\"Unsupported authorization method: \" + authorizationType);\n      }\n\n      final String credentials;\n\n      try {\n        credentials = new String(Base64.getDecoder().decode(header.substring(spaceIndex + 1)));\n      } catch (final IndexOutOfBoundsException e) {\n        throw new InvalidAuthorizationHeaderException(\"Missing credentials\");\n      }\n\n      if (StringUtils.isEmpty(credentials)) {\n        throw new InvalidAuthorizationHeaderException(\"Bad decoded value: \" + credentials);\n      }\n\n      final int credentialSeparatorIndex = credentials.indexOf(':');\n\n      if (credentialSeparatorIndex == -1) {\n        throw new InvalidAuthorizationHeaderException(\"Badly-formatted credentials: \" + credentials);","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/signalapp/Signal-Server/blob/100ab61c82627582c867d19e1c0561ba2781e927/service/src/main/java/org/whispersystems/textsecuregcm/auth/BasicAuthorizationHeader.java#L20-L56","documentation":"fromString throws InvalidAuthorizationHeaderException(\"Unsupported authorization method: <type>\") when the scheme before the first space is not exactly \"Basic\" (case-sensitive). The parser only supports Basic authentication.","triggerScenarios":"Sending \"Bearer <token>\", \"basic ...\" (lowercase), or any other scheme to an endpoint authenticated by BasicAuthorizationHeader.","commonSituations":"Clients configured for token/bearer auth hitting a basic-auth endpoint; case-sensitivity issues; using a session token where username/password are required.","solutions":["Use scheme 'Basic' exactly with base64(username:password) credentials","Switch to the appropriate auth mechanism the endpoint expects (e.g. unidentified access key or token auth)","Fix client config to use account + password rather than a bearer token"],"exampleFix":"// before\nAuthorization: Bearer eyJhbGci...\n// after\nAuthorization: Basic \" + base64(\"+15551234567.1:password\")","handlingStrategy":"validation","validationCode":"String scheme = header.substring(0, header.indexOf(' '));\nif (!\"Basic\".equals(scheme)) throw new IllegalArgumentException(\"expected Basic scheme, got \" + scheme);","typeGuard":null,"tryCatchPattern":"try { BasicAuthorizationHeader.fromString(header); } catch (InvalidAuthorizationHeaderException e) { throw new NotAuthorizedException(\"Basic\"); }","preventionTips":["Confirm the endpoint accepts Basic auth before sending Bearer tokens","Use the exact scheme casing 'Basic'"],"tags":["http-header","basic-auth","authorization-scheme"],"backgroundTag":"invalid-enum-value","analyzedSha":"100ab61c82627582c867d19e1c0561ba2781e927","analyzedAt":"2026-09-09T13:29:47.883Z","contentChangedAt":"2026-09-09T13:29:47.883Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}