{"record":{"id":"ce4e407e7b1fe2ea","repo":"alibaba/Sentinel","slug":"you-must-set-either-password-or-authorization","errorCode":null,"errorMessage":"You must set either 'password' or 'authorization'","messagePattern":"You must set either 'password' or 'authorization'","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"sentinel-extension/sentinel-datasource-spring-cloud-config/src/main/java/com/alibaba/csp/sentinel/datasource/spring/cloud/config/SentinelRuleLocator.java","lineNumber":261,"sourceCode":"        Map<String, String> headers = new HashMap<>(client.getHeaders());\n        if (headers.containsKey(AUTHORIZATION)) {\n            // To avoid redundant addition of header\n            headers.remove(AUTHORIZATION);\n        }\n        if (!headers.isEmpty()) {\n            template.setInterceptors(Arrays.<ClientHttpRequestInterceptor>asList(\n                new GenericRequestHeaderInterceptor(headers)));\n        }\n\n        return template;\n    }\n\n    private void addAuthorizationToken(ConfigClientProperties configClientProperties,\n                                       HttpHeaders httpHeaders, String username, String password) {\n        String authorization = configClientProperties.getHeaders().get(AUTHORIZATION);\n\n        if (password != null && authorization != null) {\n            throw new IllegalStateException(\n                \"You must set either 'password' or 'authorization'\");\n        }\n\n        if (password != null) {\n            byte[] token = Base64Utils.encode((username + \":\" + password).getBytes());\n            httpHeaders.add(\"Authorization\", \"Basic \" + new String(token));\n        } else if (authorization != null) {\n            httpHeaders.add(\"Authorization\", authorization);\n        }\n\n    }\n\n    public void setRestTemplate(RestTemplate restTemplate) {\n        this.restTemplate = restTemplate;\n    }\n\n    public static class GenericRequestHeaderInterceptor\n        implements ClientHttpRequestInterceptor {","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/alibaba/Sentinel/blob/a3f40ba8e900c8489bd520274739f17235a7721c/sentinel-extension/sentinel-datasource-spring-cloud-config/src/main/java/com/alibaba/csp/sentinel/datasource/spring/cloud/config/SentinelRuleLocator.java#L243-L279","documentation":"Thrown by SentinelRuleLocator.addAuthorizationToken() when BOTH a password and an Authorization header are configured for the Config Server request. The method must choose one auth mechanism; supplying both is ambiguous, so it refuses instead of silently picking one.","triggerScenarios":"Config client properties contain spring.cloud.config.password (or username/password pair) AND a custom header spring.cloud.config.headers.Authorization=Bearer ... at the same time.","commonSituations":"Migrating from basic auth to token auth: the old password properties are left in the YAML while the new Authorization header is added; shared base config sets the password while an environment overlay adds the header.","solutions":["Remove one mechanism: delete the password/username properties and keep only headers.Authorization (or vice versa).","Check overlay/merged configs (application.yml + profile files + env vars) — the two settings may come from different files.","Prefer the Authorization header for token-based auth (OAuth2/JWT gateways); keep username/password only for basic auth."],"exampleFix":"# before\nspring.cloud.config:\n  username: user\n  password: secret\n  headers:\n    Authorization: Bearer ${token}   # both set -> throws\n\n# after\nspring.cloud.config:\n  headers:\n    Authorization: Bearer ${token}   # single auth mechanism","handlingStrategy":"validation","validationCode":"// before starting, assert only one auth mechanism is configured\nboolean hasPassword = configClientProperties.getPassword() != null;\nboolean hasAuthHeader = configClientProperties.getHeaders().containsKey(\"Authorization\");\nif (hasPassword && hasAuthHeader) {\n    throw new IllegalStateException(\"configure EITHER password OR Authorization header, not both\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    ruleLocator.locate(environment);\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"'password' or 'authorization'\")) {\n        throw new IllegalStateException(\"remove spring.cloud.config.password or the Authorization header (keep one)\", e);\n    }\n    throw e;\n}","preventionTips":["When switching auth mechanisms, remove the old properties, don't just add the new ones.","Review merged configs across profiles for conflicting auth settings."],"tags":["sentinel","spring-cloud-config","authentication","configuration","java"],"backgroundTag":null,"analyzedSha":"a3f40ba8e900c8489bd520274739f17235a7721c","analyzedAt":"2026-08-14T11:10:30.678Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}