owasp-amass/amass · error

missing username in database URI

Error message

missing username in database URI

What it means

loadDatabase requires the database URI to carry credentials; after parsing, if u.User is nil or the username part is empty, it returns this error. The library enforces authenticated connections to the graph database.

Source

Thrown at config/graphdb.go:115

	if c.GraphDBs == nil {
		c.GraphDBs = make([]*Database, 0)
	}
	c.GraphDBs = append(c.GraphDBs, db)
	return nil
}

func (c *Config) loadDatabase(dbURI string) error {
	u, err := url.Parse(dbURI)
	if err != nil {
		return err
	}
	// Check for valid scheme (database type)
	if u.Scheme == "" {
		return fmt.Errorf("missing scheme in database URI")
	}
	// Check for non-empty username
	if u.User == nil || u.User.Username() == "" {
		return fmt.Errorf("missing username in database URI")
	}
	// Check for reachable hostname
	if u.Hostname() == "" {
		return fmt.Errorf("missing hostname in database URI")
	}

	dbName := ""
	// Only get the database name if it's not empty or a single slash
	if u.Path != "" && u.Path != "/" {
		dbName = strings.TrimPrefix(u.Path, "/")
	}

	db := &Database{
		Primary:  true, // Set as primary, because it wouldn't be there otherwise.
		URL:      dbURI,
		System:   u.Scheme,
		Username: u.User.Username(),
		DBName:   dbName,

View on GitHub (pinned to 79299dce87)

Solutions

1. Embed credentials in the URI userinfo: neo4j://user:password@host:7687/db.
2. Percent-encode special characters in the password (e.g. @ -> %40, # -> %23).
3. Verify with url.Parse that u.User.Username() is non-empty before saving the config.

Example fix

// before
"database": "neo4j://localhost:7687/mydb"
// after
"database": "neo4j://user:p%40ss@localhost:7687/mydb"

u, _ := url.Parse(dbURI)
if u.User == nil || u.User.Username() == "" {
    return errors.New("database URI must include username in userinfo")
}

if err := loadDatabase(uri); err != nil {
    if strings.Contains(err.Error(), "missing username") {
        return fmt.Errorf("add user:pass@ to URI: %w", err)
    }
}

When it happens

Trigger: A configured URI like 'neo4j://localhost:7687/db' (no userinfo) or 'neo4j://:password@host/db' (empty username) reaches loadDatabase.

Common situations: Storing credentials separately and forgetting the user:pass@ userinfo; password contains characters like @ or / that were not percent-encoded and broke parsing; config migration dropped the userinfo.

Related errors

• missing scheme in database URI
• missing hostname in database URI
• unable to parse database URI query parameters: %v
• no primary database specified in the configuration
• failed to initialize database store:

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/f8f6b1363f9f5342. Report an issue: GitHub.