gofr-dev/gofr · error

user list is empty

Error message

user list is empty

What it means

errUserListEmpty is returned by NewBasicAuthProvider in GoFr's HTTP middleware when the users map (username -> password) passed to the constructor is empty. Basic-auth middleware has no credentials to check against, so it refuses to be created. This fails at construction rather than silently accepting all or no requests.

Source

Thrown at pkg/gofr/http/middleware/basic_auth.go:22

	"crypto/subtle"
	"encoding/base64"
	"errors"
	"net/http"
	"strings"

	"gofr.dev/pkg/gofr/container"
)

// BasicAuthProvider represents a basic authentication provider.
type BasicAuthProvider struct {
	Users                       map[string]string
	ValidateFunc                func(username, password string) bool
	ValidateFuncWithDatasources func(c *container.Container, username, password string) bool
	Container                   *container.Container
}

var (
	errUserListEmpty = errors.New("user list is empty")
)

// NewBasicAuthProvider returns an instance of type AuthProvider interface.
func NewBasicAuthProvider(users map[string]string) (AuthProvider, error) {
	if len(users) == 0 {
		return nil, errUserListEmpty
	}

	return &BasicAuthProvider{Users: users}, nil
}

// NewBasicAuthProviderWithValidateFunc returns an instance of type AuthProvider interface.
func NewBasicAuthProviderWithValidateFunc(c *container.Container,
	validateFunc func(c *container.Container, username, password string) bool) (AuthProvider, error) {
	if validateFunc == nil {
		return nil, errValidateFuncEmpty
	}

View on GitHub (pinned to 187eb24962)

Solutions

1. Pass a non-empty users map with at least one username/password pair
2. Check the config/env source feeding the map is populated before wiring the middleware
3. Fail at startup with a clear message if no users are configured instead of guessing
4. Keep user maps in versioned config with required-field validation

Example fix

// before
users := os.Getenv("BASIC_AUTH_USERS") // empty -> errUserListEmpty
provider, err := middleware.NewBasicAuthProvider(parseUsers(users))
// after
parsed := parseUsers(users)
if len(parsed) == 0 { log.Fatal("BASIC_AUTH_USERS must define at least one user") }
provider, err := middleware.NewBasicAuthProvider(parsed)

if len(users) == 0 {
    return errors.New("basic auth requires at least one username/password pair")
}

func hasUsers(users map[string]string) bool { return len(users) > 0 }

provider, err := middleware.NewBasicAuthProvider(users)
if err != nil {
    log.Fatalf("basic auth misconfigured: %v", err) // includes errUserListEmpty
}

When it happens

Trigger: Calling NewBasicAuthProvider(nil) or NewBasicAuthProvider(map[string]string{}).

Common situations: Basic-auth users loaded from env vars or config files that are missing/empty, YAML/JSON parsing that yields a nil map, or services deployed without their auth configuration.

Related errors

• api keys list is empty
• validate func is empty
• container is nil
• require non-empty provider
• invalid interval, require a value greater than 1 second

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/e2d928c8665505bf. Report an issue: GitHub.