{"record":{"id":"e2d928c8665505bf","repo":"gofr-dev/gofr","slug":"user-list-is-empty","errorCode":null,"errorMessage":"user list is empty","messagePattern":"user list is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/http/middleware/basic_auth.go","lineNumber":22,"sourceCode":"\t\"crypto/subtle\"\n\t\"encoding/base64\"\n\t\"errors\"\n\t\"net/http\"\n\t\"strings\"\n\n\t\"gofr.dev/pkg/gofr/container\"\n)\n\n// BasicAuthProvider represents a basic authentication provider.\ntype BasicAuthProvider struct {\n\tUsers                       map[string]string\n\tValidateFunc                func(username, password string) bool\n\tValidateFuncWithDatasources func(c *container.Container, username, password string) bool\n\tContainer                   *container.Container\n}\n\nvar (\n\terrUserListEmpty = errors.New(\"user list is empty\")\n)\n\n// NewBasicAuthProvider returns an instance of type AuthProvider interface.\nfunc NewBasicAuthProvider(users map[string]string) (AuthProvider, error) {\n\tif len(users) == 0 {\n\t\treturn nil, errUserListEmpty\n\t}\n\n\treturn &BasicAuthProvider{Users: users}, nil\n}\n\n// NewBasicAuthProviderWithValidateFunc returns an instance of type AuthProvider interface.\nfunc NewBasicAuthProviderWithValidateFunc(c *container.Container,\n\tvalidateFunc func(c *container.Container, username, password string) bool) (AuthProvider, error) {\n\tif validateFunc == nil {\n\t\treturn nil, errValidateFuncEmpty\n\t}\n","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/http/middleware/basic_auth.go#L4-L40","documentation":"errUserListEmpty is returned by NewBasicAuthProvider in GoFr's HTTP middleware when the users map (username -> password) passed to the constructor is empty. Basic-auth middleware has no credentials to check against, so it refuses to be created. This fails at construction rather than silently accepting all or no requests.","triggerScenarios":"Calling NewBasicAuthProvider(nil) or NewBasicAuthProvider(map[string]string{}).","commonSituations":"Basic-auth users loaded from env vars or config files that are missing/empty, YAML/JSON parsing that yields a nil map, or services deployed without their auth configuration.","solutions":["Pass a non-empty users map with at least one username/password pair","Check the config/env source feeding the map is populated before wiring the middleware","Fail at startup with a clear message if no users are configured instead of guessing","Keep user maps in versioned config with required-field validation"],"exampleFix":"// before\nusers := os.Getenv(\"BASIC_AUTH_USERS\") // empty -> errUserListEmpty\nprovider, err := middleware.NewBasicAuthProvider(parseUsers(users))\n// after\nparsed := parseUsers(users)\nif len(parsed) == 0 { log.Fatal(\"BASIC_AUTH_USERS must define at least one user\") }\nprovider, err := middleware.NewBasicAuthProvider(parsed)","handlingStrategy":"validation","validationCode":"if len(users) == 0 {\n    return errors.New(\"basic auth requires at least one username/password pair\")\n}","typeGuard":"func hasUsers(users map[string]string) bool { return len(users) > 0 }","tryCatchPattern":"provider, err := middleware.NewBasicAuthProvider(users)\nif err != nil {\n    log.Fatalf(\"basic auth misconfigured: %v\", err) // includes errUserListEmpty\n}","preventionTips":["Fail at deploy/startup if BASIC_AUTH user config is missing","Validate config files with required-field checks before parsing into maps","Keep at least one bootstrap user in version-controlled config for local/dev","Add CI tests that construct the provider with the shipped config"],"tags":["auth","basic-auth","config","gofr"],"backgroundTag":"empty-credential-config","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}