paascloud/paascloud-master · error · BusinessException

UAC10011040

UAC10011040

Error message

UAC10011040

What it means

RequestUtil.getAuthHeader throws ErrorCodeEnum.UAC10011040 when the request's Authorization header is absent or empty. It enforces that only requests carrying an Authorization header proceed to token extraction/decoding.

Solutions

1. Attach a valid Authorization header to the outgoing request (e.g. Authorization: Bearer <token>).
2. Check proxy/gateway config so the Authorization header is forwarded, not stripped.
3. In client code, guard: only call APIs requiring auth after obtaining and setting the token.

Example fix

// before
curl http://api/user/info
// after
curl -H "Authorization: Bearer <token>" http://api/user/info

String authHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
if (authHeader == null || authHeader.isEmpty()) {
    throw new AuthenticationException("Authorization header is required");
}

try {
    String header = RequestUtil.getAuthHeader(request);
} catch (BusinessException e) {
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "missing Authorization header");
}

When it happens

Trigger: Calling RequestUtil.getAuthHeader(request) on an HttpServletRequest whose Authorization header is null or "" — e.g. a direct call that skipped the gateway, a curl without -H Authorization, or a browser request without credentials.

Common situations: Clients forgetting to attach the Bearer/Basic header, gateway route misconfiguration stripping headers, CORS preflight or token-refresh requests without the header, or header name case/proxy rewrite issues.

Related errors

• Failed to decode basic authentication token
• Invalid basic authentication token
• UAC10011041
• UAC10011039
• Authentication method not supported:

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/5d9f706868b4892f. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-common/paascloud-common-core/src/main/java/com/paascloud/core/utils/RequestUtil.java:129

		if (PublicUtil.isEmpty(loginAuthDto)) {
			throw new BusinessException(ErrorCodeEnum.UAC10011039);
		}
		return loginAuthDto;

	}

	/**
	 * Gets auth header.
	 *
	 * @param request the request
	 *
	 * @return the auth header
	 */
	public static String getAuthHeader(HttpServletRequest request) {

		String authHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
		if (org.apache.commons.lang.StringUtils.isEmpty(authHeader)) {
			throw new BusinessException(ErrorCodeEnum.UAC10011040);
		}
		return authHeader;
	}

	public static String[] extractAndDecodeHeader(String header) throws IOException {

		byte[] base64Token = header.substring(6).getBytes("UTF-8");
		byte[] decoded;
		try {
			decoded = Base64.decode(base64Token);
		} catch (IllegalArgumentException e) {
			throw new BadCredentialsException("Failed to decode basic authentication token");
		}

		String token = new String(decoded, "UTF-8");

		int delim = token.indexOf(GlobalConstant.Symbol.MH);

View on GitHub (pinned to 781281a950)