goharbor/harbor · info

nil request

Error message

nil request

What it means

Jobservice SecretAuthenticator.DoAuth returns 'nil request' immediately when the *http.Request passed in is nil. It is a defensive parameter guard; in the shipped HTTP pipeline the middleware always receives a real request, so this is effectively a developer/test-path error.

Source

Thrown at src/jobservice/api/authenticator.go:51

// Authenticator defined behaviors of doing auth checking.
type Authenticator interface {
	// Auth incoming request
	//
	// req *http.Request: the incoming request
	//
	// Returns:
	// nil returned if successfully done
	// otherwise an error returned
	DoAuth(req *http.Request) error
}

// SecretAuthenticator implements interface 'Authenticator' based on simple secret.
type SecretAuthenticator struct{}

// DoAuth implements same method in interface 'Authenticator'.
func (sa *SecretAuthenticator) DoAuth(req *http.Request) error {
	if req == nil {
		return errors.New("nil request")
	}

	h := strings.TrimSpace(req.Header.Get(authHeader))
	if utils.IsEmptyStr(h) {
		return fmt.Errorf("header '%s' missing", authHeader)
	}

	if !strings.HasPrefix(h, secretPrefix) {
		return fmt.Errorf("'%s' should start with '%s'", authHeader, secretPrefix)
	}

	secret := strings.TrimSpace(strings.TrimPrefix(h, secretPrefix))
	// incase both two are empty
	if utils.IsEmptyStr(secret) {
		return errors.New("empty secret is not allowed")
	}

	expectedSecret := config.GetUIAuthSecret()

View on GitHub (pinned to 7b2fd08cc5)

Solutions

1. Pass the actual *http.Request from the handler into DoAuth
2. Guard at the call site: reject nil requests before authenticating
3. In tests, construct requests with httptest.NewRequest

Example fix

// before
_ = sa.DoAuth(nil)

// after
req := httptest.NewRequest(http.MethodGet, "/api/v1/jobs", nil)
req.Header.Set("Authorization", "Secret testsecret")
err := sa.DoAuth(req)

if req == nil {
    return errors.New("cannot authenticate a nil request")
}
err := sa.DoAuth(req)

func isNilRequestErr(err error) bool { return err != nil && strings.Contains(err.Error(), "nil request") }

if err := sa.DoAuth(req); err != nil {
    if strings.Contains(err.Error(), "nil request") {
        return errors.New("programming error: request not constructed")
    }
    return err
}

When it happens

Trigger: Programmatic use of SecretAuthenticator (unit tests, custom middleware) calling DoAuth(nil) a hand-written handler invoking the authenticator before building a request.

Common situations: Almost exclusively test code or experimental wrappers - not reachable through normal jobservice deployment.

Related errors

• empty secret is not allowed
• unauthorized
• no credential data provided
• Unauthorized
• group does not exist

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/2cddf900853ca3e8. Report an issue: GitHub.