What causes "Invalid basic authentication token" in paascloud/paascloud-master?

Encode the full username:password pair (colon required) as Base64 for the Basic header.

paascloud/paascloud-master · error · BadCredentialsException

Invalid basic authentication token

Error message

Invalid basic authentication token

What it means

RequestUtil.extractAndDecodeHeader throws BadCredentialsException("Invalid basic authentication token") when the decoded credentials string contains no ':' separator (GlobalConstant.Symbol.MH). Basic auth requires the decoded payload to be username:password; without the colon the token is structurally invalid.

Solutions

Encode the full username:password pair (colon required) as Base64 for the Basic header.
Verify client-side credential assembly; log the decoded token shape (without secrets) to debug.
If you meant Bearer auth, use the Authorization: Bearer scheme instead of Basic.

Example fix

// before
Base64.encode("adminsecret")   // no colon
// after
Base64.encode("admin:secret") // username:password

Defensive patterns

Strategy: try-catch

Validate before calling

String decoded = new String(Base64.getDecoder().decode(header.substring(6)), StandardCharsets.UTF_8);
if (decoded.indexOf(':') < 0) {
    throw new BadCredentialsException("decoded basic token must contain username:password");
}

Try / catch

try {
    String[] creds = RequestUtil.extractAndDecodeHeader(header);
} catch (BadCredentialsException e) {
    log.warn("malformed basic auth token: {}", e.getMessage());
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
}

Prevention

Always encode "username:password" (with colon) as Base64 for Basic auth.
Don't place JWTs/bearer tokens in a Basic header.
Add client-side tests verifying the decoded token contains exactly one colon.

When it happens

Trigger: Calling extractAndDecodeHeader with a valid Base64 payload whose decoded value has no colon — e.g. Base64("adminsecret") instead of Base64("admin:secret"), or sending an OAuth-style bearer token under the Basic scheme.

Common situations: Client encoding only the username or only the password, forgetting the colon delimiter, or a frontend config bug putting a JWT in a Basic header.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/0d3bb757166ff405. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-common/paascloud-common-core/src/main/java/com/paascloud/core/utils/RequestUtil.java:149

		return authHeader;
	}

	public static String[] extractAndDecodeHeader(String header) throws IOException {

		byte[] base64Token = header.substring(6).getBytes("UTF-8");
		byte[] decoded;
		try {
			decoded = Base64.decode(base64Token);
		} catch (IllegalArgumentException e) {
			throw new BadCredentialsException("Failed to decode basic authentication token");
		}

		String token = new String(decoded, "UTF-8");

		int delim = token.indexOf(GlobalConstant.Symbol.MH);

		if (delim == -1) {
			throw new BadCredentialsException("Invalid basic authentication token");
		}
		return new String[]{token.substring(0, delim), token.substring(delim + 1)};
	}
}

View on GitHub (pinned to 781281a950)