{"record":{"id":"f0f205de06555356","repo":"gofr-dev/gofr","slug":"api-keys-list-is-empty","errorCode":null,"errorMessage":"api keys list is empty","messagePattern":"api keys list is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/http/middleware/apikey_auth.go","lineNumber":14,"sourceCode":"// Package middleware provides a collection of middleware functions that handles various aspects of request handling,\n// such as authentication, logging, tracing, and metrics collection.\npackage middleware\n\nimport (\n\t\"crypto/subtle\"\n\t\"errors\"\n\t\"net/http\"\n\n\t\"gofr.dev/pkg/gofr/container\"\n)\n\nvar (\n\terrAPIKeyEmpty = errors.New(\"api keys list is empty\")\n)\n\n// APIKeyAuthProvider represents a basic authentication provider.\ntype APIKeyAuthProvider struct {\n\tValidateFunc                func(apiKey string) bool\n\tValidateFuncWithDatasources func(c *container.Container, apiKey string) bool\n\tContainer                   *container.Container\n\tAPIKeys                     []string\n}\n\n// NewAPIKeyAuthProvider instantiates an instance of type AuthProvider interface.\nfunc NewAPIKeyAuthProvider(apiKeys []string) (AuthProvider, error) {\n\tif len(apiKeys) == 0 {\n\t\treturn nil, errAPIKeyEmpty\n\t}\n\n\treturn &APIKeyAuthProvider{APIKeys: apiKeys}, nil\n}","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/http/middleware/apikey_auth.go#L1-L32","documentation":"errAPIKeyEmpty is returned by NewAPIKeyAuthProvider in GoFr's HTTP middleware when the provided API keys map/slice has no entries. The auth middleware cannot validate any request without at least one key, so construction fails fast. It is a configuration-time error, not a runtime request error.","triggerScenarios":"Calling NewAPIKeyAuthProvider(nil) or NewAPIKeyAuthProvider with an empty map/slice of API keys.","commonSituations":"Reading API keys from an environment variable or config that is unset/empty, accidentally clearing the keys list after refactoring, or wiring the auth middleware before configuration is loaded.","solutions":["Pass a non-empty map/slice of valid API keys to NewAPIKeyAuthProvider","Verify the env var or config source supplying the keys is set and parsed (e.g. strings.Split produces elements)","Add a startup-time config check so the service fails loudly before wiring middleware","Add a unit test that constructs the provider with your production config shape"],"exampleFix":"// before\nprovider, err := middleware.NewAPIKeyAuthProvider(map[string]string{}) // errAPIKeyEmpty\n// after\nkeys := map[string]string{\"admin\": os.Getenv(\"ADMIN_API_KEY\")}\nif len(keys[\"admin\"]) == 0 { log.Fatal(\"ADMIN_API_KEY not set\") }\nprovider, err := middleware.NewAPIKeyAuthProvider(keys)","handlingStrategy":"validation","validationCode":"if len(apiKeys) == 0 {\n    return fmt.Errorf(\"invalid config: api keys list must not be empty before calling NewAPIKeyAuthProvider\")\n}","typeGuard":"func hasAPIKeys(keys map[string]string) bool { return len(keys) > 0 }","tryCatchPattern":"provider, err := middleware.NewAPIKeyAuthProvider(keys)\nif err != nil {\n    log.Fatalf(\"API key auth not configured: %v\", err) // fail fast at startup\n}","preventionTips":["Load keys from env at startup and assert non-empty before wiring middleware","Add a config validation step that runs before app startup","Unit test middleware construction with the production config shape","Document required auth env vars in deployment config"],"tags":["auth","api-key","config","gofr"],"backgroundTag":"empty-api-key-list","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}