{"record":{"id":"bd62d584e5f1acb7","repo":"apache/pulsar","slug":"failed-to-get-auth-data-from-the-request","errorCode":null,"errorMessage":"Failed to get auth data from the request","messagePattern":"Failed to get auth data from the request","errorType":"http","errorClass":"RestException","httpStatus":401,"severity":"error","filePath":"pulsar-websocket/src/main/java/org/apache/pulsar/websocket/admin/WebSocketWebResource.java","lineNumber":91,"sourceCode":"                if (authMethodName != null\n                    && service().getAuthenticationService().getAuthenticationProvider(authMethodName) != null) {\n                    authenticationDataSource = service().getAuthenticationService()\n                            .getAuthenticationProvider(authMethodName)\n                            .newHttpAuthState(httpRequest).getAuthDataSource();\n                    clientId = service().getAuthenticationService().authenticateHttpRequest(\n                            httpRequest, authenticationDataSource);\n                } else {\n                    clientId = service().getAuthenticationService().authenticateHttpRequest(httpRequest);\n                    authenticationDataSource = new AuthenticationDataHttps(httpRequest);\n                }\n            } catch (AuthenticationException e) {\n                if (service().getConfig().isAuthenticationEnabled()) {\n                    throw new RestException(Status.UNAUTHORIZED, \"Failed to get clientId from request\");\n                }\n            }\n\n            if (isBlank(clientId) && service().getConfig().isAuthenticationEnabled()) {\n                throw new RestException(Status.UNAUTHORIZED, \"Failed to get auth data from the request\");\n            }\n        }\n        return clientId;\n    }\n\n    public AuthenticationDataSource authData() throws AuthenticationException {\n        return authenticationDataSource;\n    }\n\n    /**\n     * Checks whether the user has Pulsar Super-User access to the system.\n     *\n     * @throws RestException\n     *             if not authorized\n     */\n    protected void validateSuperUserAccess() {\n        if (service().getConfig().isAuthenticationEnabled()) {\n            String appId = clientAppId();","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-websocket/src/main/java/org/apache/pulsar/websocket/admin/WebSocketWebResource.java#L73-L109","documentation":"After (optional) authentication, clientAppId checks whether the resolved clientId role is blank; if it is and authentication is enabled, it returns HTTP 401 'Failed to get auth data from the request'. Unlike error 1957 this is not an AuthenticationException — authentication either didn't produce a role or the provider returned an empty identity.","triggerScenarios":"Request authenticated without producing a role string (empty header value, provider returning blank id), or the auth provider silently returns null clientId, while authenticationEnabled=true.","commonSituations":"Empty Authorization header that doesn't throw; custom authentication provider returning empty string; request routed through a gateway that strips the auth header.","solutions":["Send a valid, non-empty credential header and confirm no intermediary strips it","Check the configured authentication provider actually extracts the role (test with the provider directly)","Verify authenticationProviders configuration matches the scheme your client sends","Enable auth debug logging on the proxy to see the parsed clientId before the blank check"],"exampleFix":"// before\nAuthorization: \n// after\nAuthorization: Bearer eyJhbGciOi...","handlingStrategy":"try-catch","validationCode":"if (authHeader == null || authHeader.isBlank()) { throw new IllegalStateException(\"Authorization header empty: proxy will reject with 'Failed to get auth data'\"); }","typeGuard":"boolean roleResolvable(String clientId) { return clientId != null && !clientId.isBlank(); }","tryCatchPattern":"try { String role = clientAppId(); if (role == null || role.isBlank()) { throw new UnauthorizedException(\"no role resolved\"); } } catch (WebApplicationException e) { if (e.getResponse().getStatus() == 401) { reauthenticate(); } throw e; }","preventionTips":["Confirm the auth provider actually returns a non-empty role for your credential type","Test the provider in isolation before wiring into the proxy","Check for intermediaries stripping auth headers","Log the parsed clientId when debugging role resolution"],"tags":["rest","authentication","unauthorized"],"backgroundTag":"authentication-failed","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}