spring-projects/spring-security · error · BadCredentialsException

Empty Password

Error message

Empty Password

What it means

AbstractLdapAuthenticationProvider.authenticate() throws BadCredentialsException('Empty Password') when the credentials of the UsernamePasswordAuthenticationToken are null or blank. Many LDAP directories (notably Active Directory) treat an empty password bind as an unauthenticated bind, so the provider refuses it up front.

Source

Thrown at ldap/src/main/java/org/springframework/security/ldap/authentication/AbstractLdapAuthenticationProvider.java:79

	private GrantedAuthoritiesMapper authoritiesMapper = new NullAuthoritiesMapper();

	protected UserDetailsContextMapper userDetailsContextMapper = new LdapUserDetailsMapper();

	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
				() -> this.messages.getMessage("LdapAuthenticationProvider.onlySupports",
						"Only UsernamePasswordAuthenticationToken is supported"));
		UsernamePasswordAuthenticationToken userToken = (UsernamePasswordAuthenticationToken) authentication;
		String username = userToken.getName();
		String password = (String) authentication.getCredentials();
		if (!StringUtils.hasLength(username)) {
			throw new BadCredentialsException(
					this.messages.getMessage("LdapAuthenticationProvider.emptyUsername", "Empty Username"));
		}
		if (!StringUtils.hasLength(password)) {
			throw new BadCredentialsException(
					this.messages.getMessage("AbstractLdapAuthenticationProvider.emptyPassword", "Empty Password"));
		}
		Assert.notNull(password, "Null password was supplied in authentication token");
		DirContextOperations userData = doAuthentication(userToken);
		UserDetails user = this.userDetailsContextMapper.mapUserFromContext(userData, authentication.getName(),
				loadUserAuthorities(userData, authentication.getName(), password));
		return createSuccessfulAuthentication(userToken, user);
	}

	protected abstract DirContextOperations doAuthentication(UsernamePasswordAuthenticationToken auth);

	protected abstract Collection<? extends GrantedAuthority> loadUserAuthorities(DirContextOperations userData,
			String username, String password);

	/**
	 * Creates the final {@code Authentication} object which will be returned from the
	 * {@code authenticate} method.
	 * @param authentication the original authentication request token

View on GitHub (pinned to 96852e8860)

Solutions

1. Validate the password is non-blank before invoking the AuthenticationManager and return a 400/validation error.
2. Check your request mapping/binding actually extracts the password field (correct JSON property or form parameter name).
3. If using a custom authentication filter, ensure you pass the password as the credentials argument to the token constructor.
4. Never send empty-password binds to LDAP — this guard exists to prevent anonymous-bind style logins.

Example fix

// before
Authentication auth = new UsernamePasswordAuthenticationToken(username, request.getParameter("pwd")); // null key
manager.authenticate(auth); // Empty Password

// after
String pwd = request.getParameter("password");
if (pwd == null || pwd.isEmpty()) {
    throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "password is required");
}
Authentication auth = new UsernamePasswordAuthenticationToken(username, pwd);
manager.authenticate(auth);

if (password == null || password.isEmpty()) {
    throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "password is required");
}

static boolean hasCredentials(UsernamePasswordAuthenticationToken t) {
    return t != null && t.getCredentials() instanceof String s && !s.isEmpty();
}

try {
    return authManager.authenticate(token);
} catch (BadCredentialsException e) {
    if ("Empty Password".equals(e.getMessage())) {
        throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "password is required");
    }
    throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "invalid credentials");
}

When it happens

Trigger: Submitting a login token with null/empty credentials: an empty password field on the login form, a JSON body missing the password key, or a custom filter that forgot to set credentials when constructing UsernamePasswordAuthenticationToken.

Common situations: Password field omitted in REST payloads, form auto-submit before the user typed the password, AD environment where an empty bind would silently succeed, or password stripped by an upstream filter.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• Empty Username
• Empty Password
• Bad credentials
• ${ex.getStatus().getDefaultMessage()}
• Bad credentials

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/d83328b4cce2e855. Report an issue: GitHub.