{"record":{"id":"f0c301ec5ffc64a5","repo":"apache/rocketmq","slug":"authentication-credential-length-is-incorrect-act","errorCode":null,"errorMessage":"authentication credential length is incorrect, actual length={}.","messagePattern":"authentication credential length is incorrect, actual length=(.+?)\\.","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authentication/builder/DefaultAuthenticationContextBuilder.java","lineNumber":78,"sourceCode":"            }\n\n            String[] result = authorization.split(CommonConstants.SPACE, 2);\n            if (result.length != 2) {\n                throw new AuthenticationException(\"authentication header is incorrect.\");\n            }\n            String[] keyValues = result[1].split(CommonConstants.COMMA);\n            for (String keyValue : keyValues) {\n                String[] kv = keyValue.trim().split(CommonConstants.EQUAL, 2);\n                int kvLength = kv.length;\n                if (kv.length != 2) {\n                    throw new AuthenticationException(\"authentication keyValues length is incorrect, actual length={}.\", kvLength);\n                }\n                String authItem = kv[0];\n                if (CREDENTIAL.equals(authItem)) {\n                    String[] credential = kv[1].split(CommonConstants.SLASH);\n                    int credentialActualLength = credential.length;\n                    if (credentialActualLength == 0) {\n                        throw new AuthenticationException(\"authentication credential length is incorrect, actual length={}.\", credentialActualLength);\n                    }\n                    context.setUsername(credential[0]);\n                    continue;\n                }\n                if (SIGNATURE.equals(authItem)) {\n                    context.setSignature(this.hexToBase64(kv[1]));\n                }\n            }\n\n            context.setContent(datetime.getBytes(StandardCharsets.UTF_8));\n\n            return context;\n        } catch (AuthenticationException e) {\n            throw e;\n        } catch (Throwable e) {\n            throw new AuthenticationException(\"create authentication context error.\", e);\n        }\n    }","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authentication/builder/DefaultAuthenticationContextBuilder.java#L60-L96","documentation":"The 'Credential=<value>' pair was found, but splitting its value on '/' produced zero parts. In Java, String.split on an empty string returns an empty array, so this fires when the credential value is the empty string ('Credential=' with nothing after the '='). The username is taken from credential[0], hence the guard.","triggerScenarios":"Header contains 'Credential=' (empty value), e.g. because the username variable was null/empty when the header was built, producing an empty string after the '=' that splits into a zero-length array.","commonSituations":"Client configured with an empty or unresolvable AK/username (e.g. placeholder not substituted from environment/config); a null username string-concatenated into the header as 'null=' vs empty; misconfigured credentials file.","solutions":["Set a non-empty username/access key in the client credentials so the Credential pair has a value ('Credential=myUser').","Check the client-side config (sessionCredentials, ACL config file, environment variables) for an empty accessKey field.","Validate the built header client-side before sending: every pair must match '^[^=]+=.+$'."],"exampleFix":"// before\nString cred = \"Credential=\" + username; // username == \"\" -> 'Credential='\n\n// after\nif (username == null || username.isEmpty()) throw new IllegalStateException(\"accessKey must be set\");\nString cred = \"Credential=\" + username;","handlingStrategy":"validation","validationCode":"if (username == null || username.trim().isEmpty()) {\n    throw new IllegalStateException(\"accessKey/username must be non-empty before building the auth header\");\n}\nString credential = \"Credential=\" + username;","typeGuard":"boolean hasValidCredential(String username) { return username != null && !username.trim().isEmpty(); }","tryCatchPattern":"catch (AuthenticationException e) { if message contains \"credential length\" -> check client accessKey config, fail fast (not transient). }","preventionTips":["Validate credentials are non-empty at client startup, not per request","Fail application boot when required credential config is missing"],"tags":["rocketmq","authentication","credentials","validation"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}