SonarSource/sonarqube · warning · AuthenticationException

Authentication failed

Error message

Authentication failed

What it means

Spring @ExceptionHandler for AuthenticationException in the v2 REST API. Instead of leaking internals, it logs the exception's public message and returns HTTP 401 with a generic RestError body 'Authentication failed'.

Solutions

1. Check the server log for the public message logged just before the 401 to see why auth failed
2. Regenerate the user token and update the client/CI secret
3. Send the Authorization header correctly (Bearer <token> or Basic base64(login:password))
4. Verify the account is active and not locked/deactivated locally

Example fix

// before
curl -u wronguser:badpass http://localhost:9000/api/v2/... 
// after
curl -H "Authorization: Bearer <valid-token>" http://localhost:9000/api/v2/...

if (token == null || token.isBlank()) throw new IllegalStateException("Supply a bearer token before calling the API");

boolean hasAuth(HttpHeaders h) { return h != null && h.getFirst("Authorization") != null && !h.getFirst("Authorization").isBlank(); }

try { return api.call(); } catch (HttpClientErrorException.Unauthorized e) { refreshToken(); return api.call(); }

When it happens

Trigger: Any request to a v2 web API endpoint whose authentication (token/session/Basic credentials) fails, causing Spring Security to raise AuthenticationException which is routed to handleAuthenticationException.

Common situations: Expired or revoked user tokens; wrong Basic auth credentials in scripts/CI; calling v2 endpoints with tokens valid only for the legacy web API; missing Authorization header on protected endpoints.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication failed, verify the Client Id, Client Secret…
• Invalid personal access token
• Invalid personal access token
• Your GitLab token is expired
• Your GitLab token was revoked

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/3751c0b93ef87e51. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi-v2/src/main/java/org/sonar/server/v2/common/ServerRestResponseEntityExceptionHandler.java:41

import org.slf4j.LoggerFactory;
import org.sonar.server.authentication.event.AuthenticationException;
import org.sonar.server.v2.api.model.RestError;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;

@RestControllerAdvice
@Order(Ordered.LOWEST_PRECEDENCE - 1)
public class ServerRestResponseEntityExceptionHandler {

  private static final Logger LOGGER = LoggerFactory.getLogger(ServerRestResponseEntityExceptionHandler.class);

  @ExceptionHandler(AuthenticationException.class)
  protected ResponseEntity<RestError> handleAuthenticationException(AuthenticationException ex) {
    LOGGER.warn(ex.getPublicMessage());
    return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
        .body(new RestError(ErrorMessages.AUTHENTICATION_FAILED.getMessage()));
  }
}

View on GitHub (pinned to 184c821202)