signalapp/Signal-Server · error · InvalidAuthorizationHeaderException

Username or password were blank

Error message

Username or password were blank

What it means

fromString throws InvalidAuthorizationHeaderException("Username or password were blank") when either the parsed username component or the password substring is blank, even though the colon separator existed.

Solutions

1. Provide both a non-blank username (account identifier, optionally with .deviceId) and non-blank password
2. Validate credentials client-side before encoding
3. Re-fetch or regenerate the account's auth credentials if one part is missing

Example fix

// before
String creds = base64(":" + password);
// after
String creds = base64(accountNumber + ".1:" + password);

String[] parts = decoded.split(":", 2);
if (parts.length != 2 || parts[0].isBlank() || parts[1].isBlank()) throw new IllegalArgumentException("username and password must both be non-blank");

try { BasicAuthorizationHeader.fromString(header); } catch (InvalidAuthorizationHeaderException e) { throw new NotAuthorizedException("Basic"); }

When it happens

Trigger: base64(":password") (blank username), base64("username:") (blank password), or base64(" : ").

Common situations: Config with a set username but missing password (or vice versa); device ID parsing producing an empty username; partial credentials copied from a store.

Related errors

• Bad decoded value:
• Badly-formatted credentials:
• Blank header
• Invalid authorization header:
• Unsupported authorization method:

AI-assisted analysis of signalapp/Signal-Server@100ab61c82 (2026-09-09). Data as JSON: /api/errors/fb3fcd54c415125a. Report an issue: GitHub.

Appendix: source

Thrown at service/src/main/java/org/whispersystems/textsecuregcm/auth/BasicAuthorizationHeader.java:74

        throw new InvalidAuthorizationHeaderException("Badly-formatted credentials: " + credentials);
      }

      final String usernameComponent = credentials.substring(0, credentialSeparatorIndex);

      final String username;
      final byte deviceId;
      {
        final Pair<String, Byte> identifierAndDeviceId =
            AccountAuthenticator.getIdentifierAndDeviceId(usernameComponent);

        username = identifierAndDeviceId.first();
        deviceId = identifierAndDeviceId.second();
      }

      final String password = credentials.substring(credentialSeparatorIndex + 1);

      if (StringUtils.isAnyBlank(username, password)) {
        throw new InvalidAuthorizationHeaderException("Username or password were blank");
      }

      return new BasicAuthorizationHeader(username, deviceId, password);
    } catch (final IllegalArgumentException | IndexOutOfBoundsException e) {
      throw new InvalidAuthorizationHeaderException(e);
    }
  }

  public String getUsername() {
    return username;
  }

  public long getDeviceId() {
    return deviceId;
  }

  public String getPassword() {
    return password;

View on GitHub (pinned to 100ab61c82)