{"record":{"id":"f988250d42d500a6","repo":"apolloconfig/apollo","slug":"unsupported-auth-type-s-f98825","errorCode":null,"errorMessage":"Unsupported auth type: %s","messagePattern":"Unsupported auth type: (.+?)","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceBranchController.java","lineNumber":286,"sourceCode":"        || UserIdentityConstants.USER_TOKEN.equals(authType)) {\n      UserInfo loginUser = userInfoHolder.getUser();\n      if (loginUser == null || StringUtils.isBlank(loginUser.getUserId())) {\n        throw new BadRequestException(\"Current user not found\");\n      }\n      return loginUser.getUserId();\n    }\n\n    if (UserIdentityConstants.CONSUMER.equals(authType)) {\n      String operator = StringUtils.isBlank(queryOperator) ? payloadOperator : queryOperator;\n      RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(operator),\n          \"operator should not be null or empty\");\n      if (userService.findByUserId(operator) == null) {\n        throw BadRequestException.userNotExists(operator);\n      }\n      return operator;\n    }\n\n    throw new BadRequestException(\"Unsupported auth type: %s\", authType);\n  }\n\n  private boolean shouldHideConfigToCurrentUser(String appId, String env, String clusterName,\n      String namespaceName) {\n    return UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName);\n  }\n\n  private void requireConfigReadForUserToken(String appId, String env, String clusterName,\n      String namespaceName) {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName)) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n  }\n}","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceBranchController.java#L268-L304","documentation":"HTTP 400 (BadRequestException). Thrown by NamespaceBranchController.resolveOperator when UserIdentityContextHolder.getAuthType() is not one of USER, USER_TOKEN, or CONSUMER (e.g. ANONYMOUS, null, or an unknown value). The controller cannot decide how to derive the operator string without a recognized auth type.","triggerScenarios":"Any NamespaceBranch mutating API call where the request was authenticated as ANONYMOUS (or where the auth-type context was never set) and still reached the controller. Indicates a missing authentication filter or a public endpoint that should have been protected.","commonSituations":"An endpoint misconfigured to permit anonymous access; a security filter that failed to set UserIdentityContextHolder.authType; a new auth scheme introduced without registering its auth-type constant; integration tests hitting the controller bean directly without a security context.","solutions":["Ensure the request authenticates with one of the supported mechanisms (portal SSO -> USER, user-token -> USER_TOKEN, OpenAPI token -> CONSUMER).","Fix the security filter so it populates UserIdentityContextHolder.authType for every authenticated request.","If anonymous must reach this path, gate it earlier or reject it before the controller; resolveOperator has no anonymous fallback.","Check that the auth-type constant matches exactly 'USER'/'USER_TOKEN'/'CONSUMER'."],"exampleFix":"// before: authType = ANONYMOUS (or null) -> 400\nString operator = resolveOperator(query, payload);\n\n// after: authenticate as a supported type\n// CONSUMER with explicit operator\nclient.withOpenApiToken(token).createBranch(..., operator=\"svcacct\");","handlingStrategy":"validation","validationCode":"// Ensure a recognized auth type before any write.\nString authType = UserIdentityContextHolder.getAuthType();\nif (!Set.of(\"USER\",\"USER_TOKEN\",\"CONSUMER\").contains(authType)) {\n  // authenticate properly; do not call resolveOperator\n}","typeGuard":"null","tryCatchPattern":"try {\n  client.createBranch(appId, env, cluster, ns, operator);\n} catch (HttpClientErrorException.BadRequest e) {\n  if (e.getResponseBodyAsString().contains(\"Unsupported auth type\")) {\n    // switch to a supported auth mechanism (CONSUMER + operator)\n  }\n}","preventionTips":["Authenticate every mutating request as USER, USER_TOKEN, or CONSUMER.","Reject anonymous requests in the security filter before controllers run.","Keep auth-type constants in sync across any custom auth integration."],"tags":["apollo-portal","openapi","auth","bad-request","operator","anonymous"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}