winsw/winsw · error · InvalidDataException

Basic Auth is enabled, but username is not specified {ShortI

Error message

Basic Auth is enabled, but username is not specified {ShortId}

What it means

With auth="Basic" on a download, a user attribute is required. If Username is null after parsing attributes, construction throws InvalidDataException. This check runs after the cleartext guard, so it only fires once the http(s)/unsecureAuth condition is satisfied.

Source

Thrown at src/WinSW.Core/Download.cs:99

            this.Auth = XmlHelper.EnumAttribute(n, "auth", AuthType.None);
            this.Username = XmlHelper.SingleAttribute<string>(n, "user", null);
            this.Password = XmlHelper.SingleAttribute<string>(n, "password", null);
            this.UnsecureAuth = XmlHelper.SingleAttribute(n, "unsecureAuth", false);

            if (this.Auth == AuthType.Basic)
            {
                // Allow it only for HTTPS or for UnsecureAuth
                if (!this.From.StartsWith("https:") && !this.UnsecureAuth)
                {
                    throw new InvalidDataException("Warning: you're sending your credentials in clear text to the server " + this.ShortId +
                                                   "If you really want this you must enable 'unsecureAuth' in the configuration");
                }

                // Also fail if there is no user/password
                if (this.Username is null)
                {
                    throw new InvalidDataException("Basic Auth is enabled, but username is not specified " + this.ShortId);
                }

                if (this.Password is null)
                {
                    throw new InvalidDataException("Basic Auth is enabled, but password is not specified " + this.ShortId);
                }
            }
        }

        // Source: http://stackoverflow.com/questions/2764577/forcing-basic-authentication-in-webrequest
        private static void SetBasicAuthHeader(WebRequest request, string username, string password)
        {
            string authInfo = username + ":" + password;
            authInfo = Convert.ToBase64String(Encoding.GetEncoding("ISO-8859-1").GetBytes(authInfo));
            request.Headers["Authorization"] = "Basic " + authInfo;
        }

        /// <summary>

View on GitHub (pinned to 1d0ee4a91b)

Solutions

Add user="..." to the download element.
If you didn't mean to use Basic auth, remove auth="basic" (default is None).
Confirm the attribute is named user (not username).

Example fix

<!-- before -->
<download from="https://srv/p" auth="basic" password="p" />
<!-- after -->
<download from="https://srv/p" auth="basic" user="u" password="p" />

Defensive patterns

Strategy: validation

Validate before calling

foreach (XmlElement dl in dom.DocumentElement!.SelectNodes("download")!)
    if (dl.GetAttribute("auth").Equals("basic", StringComparison.OrdinalIgnoreCase) && dl.GetAttribute("user") is null or "")
        throw new InvalidOperationException("Basic auth requires a user attribute");

Try / catch

try { /* download init */ }
catch (InvalidDataException ex) when (ex.Message.Contains("username is not specified")) { /* add user */ }

Prevention

Attribute is named user (not username).
Provide both user and password for Basic auth.
Drop auth="basic" if unused.

When it happens

Trigger: <download auth="basic" password="p"/> with no user attribute, or auth="basic" with neither credential.

Common situations: Configured Basic auth but only supplied a password; typo'd user as username; intended to use a different auth type.

Related errors

AI-assisted analysis of winsw/winsw@1d0ee4a91b (2026-08-13). Data as JSON: /api/errors/04cb453c4e9bb922. Report an issue: GitHub.