{"record":{"id":"eeee0133af45958b","repo":"ory/kratos","slug":"basic-auth-auth-strategy-requires-a-string-passwor","errorCode":null,"errorMessage":"basic_auth auth strategy requires a string password","messagePattern":"basic_auth auth strategy requires a string password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"request/auth.go","lineNumber":51,"sourceCode":"\tcase \"api_key\":\n\t\tname, ok := config[\"name\"].(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"api_key auth strategy requires a string name\")\n\t\t}\n\t\tvalue, ok := config[\"value\"].(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"api_key auth strategy requires a string value\")\n\t\t}\n\t\tin, _ := config[\"in\"].(string) // in is optional\n\t\treturn NewAPIKeyStrategy(in, name, value), nil\n\tcase \"basic_auth\":\n\t\tuser, ok := config[\"user\"].(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"basic_auth auth strategy requires a string user\")\n\t\t}\n\t\tpassword, ok := config[\"password\"].(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"basic_auth auth strategy requires a string password\")\n\t\t}\n\t\treturn NewBasicAuthStrategy(user, password), nil\n\t}\n\n\treturn nil, fmt.Errorf(\"unsupported auth type: %s\", typ)\n}\n\nfunc NewNoopAuthStrategy() AuthStrategy {\n\treturn &noopAuthStrategy{}\n}\n\nfunc (c *noopAuthStrategy) apply(_ *retryablehttp.Request) {}\n\nfunc NewBasicAuthStrategy(user, password string) AuthStrategy {\n\treturn &basicAuthStrategy{\n\t\tuser:     user,\n\t\tpassword: password,\n\t}","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/request/auth.go#L33-L69","documentation":"The auth strategy factory was building the basic_auth strategy and the 'user' field passed validation, but the 'password' key in the config map is missing or not a Go string. The type assertion config[\"password\"].(string) failed, aborting strategy construction.","triggerScenarios":"basic_auth auth config without \"password\", or a non-string password (unquoted all-digit password parsed as int, bool, object, null).","commonSituations":"Passwords made only of digits parsed as YAML integers; env templating producing empty/null; moving from api_key to basic_auth without renaming value -> password.","solutions":["Quote the password in YAML: password: \"12345678\"","Set the password key explicitly (not value) for basic_auth","Verify the env var backing the password is set and non-empty","Confirm \"user\" is a string too, since the earlier check would fail first"],"exampleFix":"// before\nauth:\n  type: basic_auth\n  user: alice\n  password: 12345678\n// after\nauth:\n  type: basic_auth\n  user: alice\n  password: \"12345678\"","handlingStrategy":"validation","validationCode":"// Go: check basic_auth password before building\nfunc validateBasicAuthPassword(cfg map[string]interface{}) error {\n\tp, ok := cfg[\"password\"].(string)\n\tif !ok || p == \"\" {\n\t\treturn errors.New(\"basic_auth requires a non-empty string password\")\n\t}\n\treturn nil\n}","typeGuard":"func hasBasicAuthPassword(cfg map[string]interface{}) bool {\n\tp, ok := cfg[\"password\"].(string)\n\treturn ok && p != \"\"\n}","tryCatchPattern":"b, err := request.NewBuilder(cfg)\nif err != nil {\n\tif strings.Contains(err.Error(), \"requires a string password\") {\n\t\treturn fmt.Errorf(\"quote the basic_auth password in YAML so it is a string\")\n\t}\n\treturn err\n}","preventionTips":["Always quote passwords, especially digit-only ones","Use the key \"password\", not \"value\" or \"pass\"","Check secret env substitution produces a non-empty string","Lint config files with a YAML parser that reports coercion"],"tags":["configuration","auth","basic-auth","type-mismatch"],"backgroundTag":"config-type-mismatch","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}