Confusing error message when incorrectly using a clear text password

[loic-sharma]

The nuget.config file uses the Password key for encrypted passwords and the ClearTextPassword key for clear text passwords. Installing a package when a clear text password has been added to the Password key results in a confusing error message:

Unable to load the service index for source https://api.nuget.org/v3/index.json.
  Invalid length for a Base-64 char array or string.

Instead, I'd recommend an error message like:

Unable to load the service index for source https://api.nuget.org/v3/index.json.
  The password for package source 'abc' is invalid.

Details about Problem

NuGet product used: nuget.exe and dotnet.exe
NuGet version (x.x.x.xxx): 4.9.3.5777
dotnet.exe --version: 5.0.100-preview.2.20157.4
OS version (i.e. win10 v1607 (14393.321)): Windows 10

Detailed repro steps so we can see the same problem

Add the following nuget.config file to your project:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <!--To inherit the global NuGet package sources remove the <clear/> line below -->
    <clear />
    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <nuget>
      <add key="Username" value="foo" />
      <add key="Password" value="bar" />
    </nuget>
  </packageSourceCredentials>
</configuration>

Notice I am incorrectly using a clear text password bar with the Password key. I should be using the ClearTextPassword key instead. See: https://docs.microsoft.com/en-us/nuget/reference/nuget-config-file#packagesourcecredentials

Now, try to install a package using nuget.exe:

PS D:\Code\x> nuget.exe install FooBar
Feeds used:
  https://api.nuget.org/v3/index.json

Installing package 'FooBar' to 'D:\Code\x'.
Unable to load the service index for source https://api.nuget.org/v3/index.json.
  Invalid length for a Base-64 char array or string.

Or dotnet.exe:

PS D:\Code\x> dotnet add package FooBar
  Writing C:\Users\sharm\AppData\Local\Temp\tmpF97.tmp
info : Adding PackageReference for package 'FooBar' into project 'D:\Code\x\x.csproj'.
info : Restoring packages for D:\Code\x\x.csproj...
error: Unable to load the service index for source https://api.nuget.org/v3/index.json.
error:   The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.

...

...

Other suggested things

Verbose Logs

Verbose Logs

PS D:\Code\x> nuget.exe install FooBar -Verbosity detailed
NuGet Version: 4.9.3.5777
Feeds used:
  https://api.nuget.org/v3/index.json

Installing package 'FooBar' to 'D:\Code\x'.
Unable to load the service index for source https://api.nuget.org/v3/index.json.
  Invalid length for a Base-64 char array or string.
NuGet.Protocol.Core.Types.FatalProtocolException: Unable to load the service index for source https://api.nuget.org/v3/index.json. ---> System.FormatException: Invalid length for a Base-64 char array or string
.
   at System.Convert.FromBase64_Decode(Char* startInputPtr, Int32 inputLength, Byte* startDestPtr, Int32 destLength)
   at System.Convert.FromBase64CharPtr(Char* inputPtr, Int32 inputLength)
   at System.Convert.FromBase64String(String s)
   at NuGet.Configuration.EncryptionUtility.DecryptString(String encryptedString)
   at NuGet.Configuration.PackageSourceCredential.get_Password()
   at NuGet.Protocol.HttpSourceAuthenticationHandler..ctor(PackageSource packageSource, HttpClientHandler clientHandler, ICredentialService credentialService)
   at NuGet.Protocol.HttpHandlerResourceV3Provider.CreateResource(PackageSource packageSource)
   at NuGet.Protocol.HttpHandlerResourceV3Provider.TryCreate(SourceRepository source, CancellationToken token)
   at NuGet.Protocol.Core.Types.SourceRepository.<GetResourceAsync>d__16`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.Core.Types.SourceRepository.<GetResourceAsync>d__15`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.HttpSource.<CreateHttpClientAsync>d__22.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.HttpSource.<EnsureHttpClientAsync>d__21.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.HttpSource.<GetThrottledResponse>d__20.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.HttpSource.<>c__DisplayClass14_0`1.<<GetAsync>b__0>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Common.ConcurrencyUtilities.<ExecuteWithFileLockedAsync>d__2`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.HttpSource.<GetAsync>d__14`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at NuGet.Protocol.ServiceIndexResourceV3Provider.<GetServiceIndexResourceV3>d__9.MoveNext()
   --- End of inner exception stack trace ---
   at NuGet.Protocol.ServiceIndexResourceV3Provider.<GetServiceIndexResourceV3>d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.ServiceIndexResourceV3Provider.<TryCreate>d__8.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at NuGet.Protocol.Core.Types.SourceRepository.<GetResourceAsync>d__16`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.DependencyInfoResourceV3Provider.<TryCreate>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at NuGet.Protocol.Core.Types.SourceRepository.<GetResourceAsync>d__16`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.Protocol.Core.Types.SourceRepository.<GetResourceAsync>d__15`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.PackageManagement.NuGetPackageManager.<GetLatestVersionCoreAsync>d__94.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.PackageManagement.NuGetPackageManager.<>c__DisplayClass92_1.<<GetLatestVersionAsync>b__3>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.PackageManagement.NuGetPackageManager.<GetLatestVersionAsync>d__92.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.PackageManagement.NuGetPackageManager.<GetLatestVersionAsync>d__91.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at NuGet.CommandLine.InstallCommand.<InstallPackageAsync>d__40.MoveNext()

[nkolev92]

Nice catch :)

I'd argue this is lower priority right now so I'm putting it in the icebox and but marking it as up for grabs.

[niektuytel]

Any update on this?

[nzain]

Just ran into this error message... and I'm not sure what's wrong on my side. I'm using generated API keys with the companys Artifactory server (which hosts several nuget feeds). I'm pretty sure it has been working before (like a month ago). On the other hand, this was the first time I'm working with Artifactory based nuget feeds.

I figured out that my credentials now have to be declared as ClearTextPassword while Password was working a month ago... for anyone else coming here, this is how it could look.

  <packageSourceCredentials>
    <MyRepoName>
      <add key="Username" value="my_email@company.com"/>
      <add key="ClearTextPassword" value="abcde...my lengthy API key"/>
    </MyRepoName>
  </packageSourceCredentials>

[acraven]

This just bit me. With hindsight there were some Base64 errors in the diagnostics but it wasn't clear these were due to the Password field not being valid Base64.