{"record":{"id":"d850e14a0c67664b","repo":"apache/pulsar","slug":"authentication-method-missing","errorCode":null,"errorMessage":"Authentication method missing","messagePattern":"Authentication method missing","errorType":"http","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationService.java","lineNumber":145,"sourceCode":"        if (authMethodName == null\n                && SaslConstants.SASL_TYPE_VALUE.equalsIgnoreCase(request.getHeader(SaslConstants.SASL_HEADER_TYPE))) {\n            // This edge case must be handled because the Pulsar SASL implementation does not add the\n            // X-Pulsar-Auth-Method-Name header.\n            authMethodName = SaslConstants.AUTH_METHOD_NAME;\n        }\n        if (authMethodName != null) {\n            AuthenticationProvider providerToUse = getAuthProvider(authMethodName);\n            try {\n                return providerToUse.authenticateHttpRequest(request, response);\n            } catch (Exception e) {\n                log.debug().attr(\"authMethod\", authMethodName).exception(e)\n                        .log(\"Authentication failed for provider\");\n                throw e;\n            }\n        } else {\n            if (strictAuthMethod) {\n                log.debug(\"No authentication method provided while one was is required\");\n                throw new AuthenticationException(\"Authentication method missing\");\n            }\n            for (AuthenticationProvider provider : providers.values()) {\n                try {\n                    return provider.authenticateHttpRequest(request, response);\n                } catch (Exception e) {\n                    log.debug().exception(e).log(\"Authentication failed for provider :\");\n                    // Ignore the exception because we don't know which authentication method is expected here.\n                }\n            }\n            // No authentication provided\n            if (!providers.isEmpty()) {\n                if (StringUtils.isNotBlank(anonymousUserRole)) {\n                    request.setAttribute(AuthenticatedRoleAttributeName, anonymousUserRole);\n                    request.setAttribute(AuthenticatedDataAttributeName, new AuthenticationDataHttps(request));\n                    return true;\n                }\n                // If at least a provider was configured, then the authentication needs to be provider\n                throw new AuthenticationException(\"Authentication required\");","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationService.java#L127-L163","documentation":"When no 'Pulsar-Auth-Method-Name' header is present on the request and the broker is configured with strictAuthMethod=true, authenticateHttpRequest throws AuthenticationException('Authentication method missing') immediately. Strict mode requires clients to explicitly declare which authentication method they use; the broker will not try every configured provider.","triggerScenarios":"HTTP request to a broker with authenticationEnabled=true and strictAuthMethod=true that lacks the Pulsar-Auth-Method-Name header (and is not a SASL request with the SASL header type); e.g. a plain unauthenticated client, curl without auth headers, or a client library too old to send the header.","commonSituations":"Operator enabled strictAuthMethod but legacy clients/proxies don't send the auth method header; health-check or monitoring probes hitting the admin API without credentials; curl/scripts testing the REST API without auth headers; SASL edge case header not set.","solutions":["Configure the client to send the Pulsar-Auth-Method-Name header and valid credentials for that method","Set strictAuthMethod=false in broker.conf to fall back to trying all configured providers for header-less requests","If the request should be anonymous, configure anonymousUserRole so unauthenticated requests get that role (requires strictAuthMethod=false)","For SASL, ensure the SASL header type header is present so the method name can be inferred"],"exampleFix":"// before (broker.conf)\nstrictAuthMethod=true\n// client: curl http://broker:8080/admin/v2/clusters  -> Authentication method missing\n// after: send auth headers\ncurl -H \"Pulsar-Auth-Method-Name: token\" -H \"Authorization: Bearer <jwt>\" http://broker:8080/admin/v2/clusters\n// or relax: strictAuthMethod=false","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    authenticated = authService.authenticateHttpRequest(request, response);\n} catch (javax.naming.AuthenticationException e) {\n    if (\"Authentication method missing\".equals(e.getMessage())) {\n        response.sendError(401, \"Pulsar-Auth-Method-Name header required (strictAuthMethod=true)\");\n    }\n}","preventionTips":["When strictAuthMethod=true, ensure all clients send Pulsar-Auth-Method-Name on every request","Exclude only intentional anonymous endpoints or set anonymousUserRole explicitly","Verify client library versions support sending the auth method header before enabling strict mode","Keep monitoring/health probes authenticated or on an auth-disabled listener"],"tags":["authentication","pulsar","http","configuration"],"backgroundTag":"missing-auth-header","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}