{"record":{"id":"f1b15b87b44c5ba0","repo":"docker/cli","slug":"username-is-empty","errorCode":null,"errorMessage":"username is empty","messagePattern":"username is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/registry/login.go","lineNumber":84,"sourceCode":"\tflags.BoolVar(&opts.passwordStdin, \"password-stdin\", false, \"Take the Password or Personal Access Token (PAT) from stdin\")\n\n\treturn cmd\n}\n\n// verifyLoginFlags validates flags set on the command.\n//\n// TODO(thaJeztah); combine with verifyLoginOptions, but this requires rewrites of many tests.\nfunc verifyLoginFlags(flags *pflag.FlagSet, opts loginOptions) error {\n\tif flags.Changed(\"password-stdin\") || opts.password == \"-\" {\n\t\tif flags.Changed(\"password\") && opts.password != \"-\" {\n\t\t\treturn errors.New(\"conflicting options: cannot specify both --password and --password-stdin\")\n\t\t}\n\t\tif !flags.Changed(\"username\") {\n\t\t\treturn errors.New(\"the --password-stdin option requires --username to be set\")\n\t\t}\n\t}\n\tif flags.Changed(\"username\") && opts.user == \"\" {\n\t\treturn errors.New(\"username is empty\")\n\t}\n\tif flags.Changed(\"password\") && opts.password == \"\" {\n\t\treturn errors.New(\"password is empty\")\n\t}\n\treturn nil\n}\n\n// readSecretFromStdin reads the secret from r and returns it as a string.\n// It trims terminal line-endings (LF, CRLF, or CR), which may be added when\n// inputting interactively or piping input. The value is otherwise treated as\n// opaque, preserving any other whitespace, including newlines, per [NIST SP 800-63B §5.1.1.2].\n// Note that trimming whitespace may still happen elsewhere (see [NIST SP 800-63B (revision 4) §3.1.1.2]);\n//\n// > Verifiers **MAY** make limited allowances for mistyping (e.g., removing\n// > leading and trailing whitespace characters before verification, allowing\n// > the verification of passwords with differing cases for the leading character)\n//\n// [NIST SP 800-63B §5.1.1.2]: https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/registry/login.go#L66-L102","documentation":"Thrown by verifyLoginFlags when the --username flag was explicitly changed but resolves to an empty string, e.g. 'docker login -u \"\"'. The flag-level guard (lines 83-84) treats an explicitly-empty username as invalid.","triggerScenarios":"Running 'docker login -u \"\"' or 'docker login --username=' (empty value) at the flag-parsing stage.","commonSituations":"Passing an unset shell variable unquoted as empty: 'docker login -u $EMPTY_VAR'; misconfigured env in scripts.","solutions":["Provide a non-empty username value.","Quote and check the variable before invoking the command.","Use --password-stdin with a guaranteed non-empty username."],"exampleFix":"# before\ndocker login -u \"\"\n# after\nUSER=${USER:?empty}; docker login -u \"$USER\" --password-stdin","handlingStrategy":"validation","validationCode":"// Reject an explicitly empty --username\nif flags.Changed(\"username\") && strings.TrimSpace(opts.user) == \"\" {\n    return fmt.Errorf(\"--username must not be empty\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Quote and default-check username variables: ${VAR:?empty}.","Validate non-empty before passing to the CLI.","Avoid passing -u with an unset environment variable."],"tags":["registry","login","auth","docker","go","cli","flags"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}