langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #29950] fix: validate API key is not empty in HTTPRequest node #32624

New Issue
Closed
opened 2026-02-21 20:51:45 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:51:45 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/29950

State: closed
Merged: Yes

Fix: HTTPRequest Node fails when API key is empty

Description

Fixes issue #21830 where the HTTPRequest node fails to execute when the API key used for authorization is empty, resulting in invalid headers like "Basic " (with no credentials) and causing "Illegal header value" errors.

Changes

Core Fix

  • Added validation in Executor.__init__ to check if API key is empty or whitespace-only after template conversion
  • Raises AuthorizationConfigError with a clear error message when API key is empty
  • Prevents invalid authorization headers from being created

Files Modified

  1. api/core/workflow/nodes/http_request/executor.py

    • Added validation after template conversion (lines 89-93)
    • Validates both empty strings and whitespace-only strings

  2. api/tests/unit_tests/core/workflow/nodes/http_request/test_http_request_executor.py

    • Added 5 new unit tests:
      • test_empty_api_key_raises_error_bearer - Tests bearer auth with empty key
      • test_empty_api_key_raises_error_basic - Tests basic auth with empty key
      • test_empty_api_key_raises_error_custom - Tests custom auth with empty key
      • test_whitespace_only_api_key_raises_error - Tests whitespace-only key
      • test_valid_api_key_works - Ensures valid keys still work

  3. api/tests/integration_tests/workflow/nodes/test_http.py

    • Updated test_custom_auth_with_empty_api_key_raises_error to expect AuthorizationConfigError
    • Updated test_custom_authorization_with_empty_api_key to verify proper error handling in node execution

Testing

Unit Tests

All new unit tests pass:

  • ✅ Empty API key validation for bearer, basic, and custom auth types
  • ✅ Whitespace-only API key validation
  • ✅ Valid API key still works correctly

Integration Tests

  • ✅ Updated integration tests to verify error handling in full node execution

Manual Testing

To test manually:

  1. Create a workflow with an HTTPRequest node
  2. Set authorization type to "api-key" (bearer, basic, or custom)
  3. Leave the API key field empty
  4. Execute the workflow
  5. Should receive a clear error: "API key is required for authorization but was empty. Please provide a valid API key."

Impact

  • Before: Empty API keys caused cryptic errors like "Illegal header value b'Basic '" during HTTP request execution
  • After: Empty API keys are caught early with a clear, actionable error message before any HTTP request is made

Related Issues

Fixes #21830

Checklist

  • Code follows project style guidelines
  • Tests added/updated
  • All tests pass
  • No linter errors
  • Error messages are clear and actionable
  • Backward compatibility maintained (valid API keys still work)
**Original Pull Request:** https://github.com/langgenius/dify/pull/29950 **State:** closed **Merged:** Yes --- # Fix: HTTPRequest Node fails when API key is empty ## Description Fixes issue #21830 where the HTTPRequest node fails to execute when the API key used for authorization is empty, resulting in invalid headers like `"Basic "` (with no credentials) and causing "Illegal header value" errors. ## Changes ### Core Fix - Added validation in `Executor.__init__` to check if API key is empty or whitespace-only after template conversion - Raises `AuthorizationConfigError` with a clear error message when API key is empty - Prevents invalid authorization headers from being created ### Files Modified 1. **`api/core/workflow/nodes/http_request/executor.py`** - Added validation after template conversion (lines 89-93) - Validates both empty strings and whitespace-only strings 2. **`api/tests/unit_tests/core/workflow/nodes/http_request/test_http_request_executor.py`** - Added 5 new unit tests: - `test_empty_api_key_raises_error_bearer` - Tests bearer auth with empty key - `test_empty_api_key_raises_error_basic` - Tests basic auth with empty key - `test_empty_api_key_raises_error_custom` - Tests custom auth with empty key - `test_whitespace_only_api_key_raises_error` - Tests whitespace-only key - `test_valid_api_key_works` - Ensures valid keys still work 3. **`api/tests/integration_tests/workflow/nodes/test_http.py`** - Updated `test_custom_auth_with_empty_api_key_raises_error` to expect `AuthorizationConfigError` - Updated `test_custom_authorization_with_empty_api_key` to verify proper error handling in node execution ## Testing ### Unit Tests All new unit tests pass: - ✅ Empty API key validation for bearer, basic, and custom auth types - ✅ Whitespace-only API key validation - ✅ Valid API key still works correctly ### Integration Tests - ✅ Updated integration tests to verify error handling in full node execution ### Manual Testing To test manually: 1. Create a workflow with an HTTPRequest node 2. Set authorization type to "api-key" (bearer, basic, or custom) 3. Leave the API key field empty 4. Execute the workflow 5. Should receive a clear error: "API key is required for authorization but was empty. Please provide a valid API key." ## Impact - **Before**: Empty API keys caused cryptic errors like "Illegal header value b'Basic '" during HTTP request execution - **After**: Empty API keys are caught early with a clear, actionable error message before any HTTP request is made ## Related Issues Fixes #21830 ## Checklist - [x] Code follows project style guidelines - [x] Tests added/updated - [x] All tests pass - [x] No linter errors - [x] Error messages are clear and actionable - [x] Backward compatibility maintained (valid API keys still work)
yindo added the pull-request label 2026-02-21 20:51:45 -05:00
yindo closed this issue 2026-02-21 20:51:46 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#32624
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?