{"id":"ae65f36c4939b8f2","repo":"mongodb/node-mongodb-native","slug":"password-cannot-be-empty","errorCode":null,"errorMessage":"Password cannot be empty","messagePattern":"Password cannot be empty","errorType":"exception","errorClass":"MongoInvalidArgumentError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/scram.ts","lineNumber":227,"sourceCode":"  const parts = payloadStr.split(',');\n  for (let i = 0; i < parts.length; i++) {\n    const valueParts = (parts[i].match(/^([^=]*)=(.*)$/) ?? []).slice(1);\n    dict[valueParts[0]] = valueParts[1];\n  }\n  return dict;\n}\n\nfunction passwordDigest(username: string, password: string) {\n  if (typeof username !== 'string') {\n    throw new MongoInvalidArgumentError('Username must be a string');\n  }\n\n  if (typeof password !== 'string') {\n    throw new MongoInvalidArgumentError('Password must be a string');\n  }\n\n  if (password.length === 0) {\n    throw new MongoInvalidArgumentError('Password cannot be empty');\n  }\n\n  let nodeCrypto;\n  try {\n    // TODO: NODE-7424 - remove dependency on 'crypto' for SCRAM-SHA-1 authentication\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    nodeCrypto = require('crypto');\n  } catch (e) {\n    throw new MongoRuntimeError(\n      'Node.js crypto module is required for SCRAM-SHA-1 authentication',\n      {\n        cause: e\n      }\n    );\n  }\n\n  try {\n    const md5 = nodeCrypto.createHash('md5');","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/scram.ts#L209-L245","documentation":"Thrown by passwordDigest() (scram.ts:227) as a MongoInvalidArgumentError when the password is an empty string. An empty password is rejected because SCRAM-SHA-1 derives a deterministic, trivially-brute-forced digest from it - a security defect the driver refuses to allow. Distinct from 'wrong password'; this is 'no password at all'.","triggerScenarios":"Credentials built with password === '' - e.g. a connection string with an empty password segment ('user:@host') or a credentials resolver that returned an empty string after stripping whitespace.","commonSituations":"Connection string 'mongodb://user:@host' with empty password; env var DB_PASS unset (empty string default); secret-manager lookup returning '' for a not-yet-provisioned secret; trimming a whitespace-only password to empty.","solutions":["Set a real, non-empty password on the MongoDB user and in the connection string","Verify the password env var is actually set and non-empty before constructing the client","If loading from a secret store, fail fast when the secret value is empty rather than passing ''"],"exampleFix":"// before\nconst client = new MongoClient('mongodb://user:@host'); // empty password\n// after\nconst client = new MongoClient(`mongodb://user:${encodeURIComponent(process.env.DB_PASS)}@host`);","handlingStrategy":"validation","validationCode":"function assertNonEmptyPassword(p: unknown): asserts p is string {\n  if (typeof p !== 'string' || p.length === 0) throw new Error('password must be a non-empty string');\n}\nassertNonEmptyPassword(process.env.DB_PASS);","typeGuard":"function isNonEmptyPassword(p: unknown): p is string {\n  return typeof p === 'string' && p.length > 0;\n}","tryCatchPattern":null,"preventionTips":["Assert password env vars are set and non-empty at app startup","Fail fast when secret stores return empty values","Avoid passing whitespace-trimmed passwords that become empty"],"tags":["auth","scram","credentials","security","validation"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}