{"record":{"id":"c48b0f6d5bd3ac96","repo":"tinyhumansai/openhuman","slug":"http-cred-bearer-token-is-empty","errorCode":null,"errorMessage":"http_cred '{}': bearer token is empty","messagePattern":"http_cred '(.+?)': bearer token is empty","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/openhuman/security/credentials/http_creds.rs","lineNumber":125,"sourceCode":"        let now = Utc::now();\n        Self {\n            name: name.into(),\n            scheme: HttpCredentialScheme::Header,\n            header_name: Some(header_name.into()),\n            username: None,\n            secret: value.into(),\n            created_at: now,\n            updated_at: now,\n        }\n    }\n\n    /// The `(header_name, header_value)` pair to inject onto the outbound\n    /// request. **The returned value contains the secret** — callers must merge\n    /// it into the request server-side and must never log or echo it.\n    pub fn to_header(&self) -> Result<(String, String)> {\n        match self.scheme {\n            HttpCredentialScheme::Bearer => {\n                anyhow::ensure!(\n                    !self.secret.trim().is_empty(),\n                    \"http_cred '{}': bearer token is empty\",\n                    self.name\n                );\n                Ok((\n                    \"Authorization\".to_string(),\n                    format!(\"Bearer {}\", self.secret),\n                ))\n            }\n            HttpCredentialScheme::Basic => {\n                let username = self.username.as_deref().unwrap_or_default();\n                let encoded = base64::engine::general_purpose::STANDARD\n                    .encode(format!(\"{username}:{}\", self.secret));\n                Ok((\"Authorization\".to_string(), format!(\"Basic {encoded}\")))\n            }\n            HttpCredentialScheme::Header => {\n                let header_name = self\n                    .header_name","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/security/credentials/http_creds.rs#L107-L143","documentation":"An HTTP credential using the Header scheme (or Basic) produced an empty bearer/header token when materialized to request headers. The credential's secret field is empty, so `to_header()` refuses to inject an empty Authorization value — a data-integrity guard on the stored credential, not a transport error.","triggerScenarios":"Thrown at src/openhuman/security/credentials/http_creds.rs:125 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-create or update the http_cred with a non-empty token","Check how the credential was inserted — an empty secret should have been rejected upstream","Never log the secret while debugging; only check emptiness"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}