prestodb/presto · error · ClientException

Illegal character ':' found in username

Error message

Illegal character ':' found in username

What it means

OkHttpUtil.basicAuth builds HTTP Basic auth credentials, which encode user and password as 'user:password'. A colon inside the username would corrupt that encoding, so the library proactively throws ClientException when the user string contains ':'.

Source

Thrown at presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java:90

        public void onFailure(Call call, IOException e) {}

        @Override
        public void onResponse(Call call, Response response) {}
    }

    public static Interceptor userAgent(String userAgent)
    {
        return chain -> chain.proceed(chain.request().newBuilder()
                .header(USER_AGENT, userAgent)
                .build());
    }

    public static Interceptor basicAuth(String user, String password)
    {
        requireNonNull(user, "user is null");
        requireNonNull(password, "password is null");
        if (user.contains(":")) {
            throw new ClientException("Illegal character ':' found in username");
        }

        String credential = Credentials.basic(user, password);
        return chain -> chain.proceed(chain.request().newBuilder()
                .header(AUTHORIZATION, credential)
                .build());
    }

    public static Interceptor tokenAuth(String accessToken)
    {
        requireNonNull(accessToken, "accessToken is null");
        checkArgument(CharMatcher.inRange((char) 33, (char) 126).matchesAllOf(accessToken));

        return chain -> chain.proceed(chain.request().newBuilder()
                .addHeader(AUTHORIZATION, "Bearer " + accessToken)
                .build());
    }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Split the value on the first ':' and pass the part before it as user and the part after as password.
2. Fix the configuration source so username and password are separate fields/variables.
3. If a colon is genuinely part of the username, use a different auth mechanism (e.g. Kerberos or a token header) instead of basicAuth.
4. Validate the username in your own config-loading code before constructing the client.

Example fix

// before
Interceptor auth = OkHttpUtil.basicAuth("alice:secret", null); // ClientException
// after
String[] parts = config.split(":", 2);
Interceptor auth = OkHttpUtil.basicAuth(parts[0], parts[1]);

if (user == null || user.contains(":")) {
    throw new IllegalArgumentException("username must not contain ':'; split user:password into separate fields");
}

try { Interceptor auth = OkHttpUtil.basicAuth(user, password); } catch (ClientException e) { /* fix credential splitting in config */ }

When it happens

Trigger: Calling OkHttpUtil.basicAuth(user, password) where user contains a colon — typically when a full 'user:password' pair is mistakenly passed as the user argument, or from client session/property wiring that concatenates credentials.

Common situations: Config files or connection strings where credentials were specified as 'alice:secret' and the whole string was passed as the username; copy-pasted JDBC URLs; environment variables combining user and password with a separator.

Related errors

• UNEXPECTED_ACCUMULO_ERROR
• Failed to create Credentials from key
• Response does not contain a JSON value
• Error setting up SSL:
• Invalid server URL:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/1853ce82aee1fca6. Report an issue: GitHub.