SonarSource/sonarqube · error · UnauthorizedException

Authentication is required

Error message

Authentication is required

What it means

AbstractUserSession.checkLoggedIn throws UnauthorizedException when the current session has no authenticated user. It is the standard guard enforcing that a web service or action requires an authenticated session before proceeding.

Source

Thrown at server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java:171

    return entities.stream()
      .filter(c -> (allowPublicComponent && !c.isPrivate()) || hasEntityPermission(permission, c.getUuid()))
      .toList();
  }

  /**
   * Naive implementation, to be overridden if needed
   */
  protected List<ComponentDto> doKeepAuthorizedComponents(ProjectPermission permission, Collection<ComponentDto> components) {
    boolean allowPublicComponent = ProjectPermission.PUBLIC_PERMISSIONS.contains(permission);
    return components.stream()
      .filter(c -> (allowPublicComponent && !c.isPrivate()) || hasComponentPermission(permission, c))
      .toList();
  }

  @Override
  public final UserSession checkLoggedIn() {
    if (!isLoggedIn()) {
      throw new UnauthorizedException(AUTHENTICATION_IS_REQUIRED_MESSAGE);
    }
    return this;
  }

  @Override
  public final UserSession checkPermission(GlobalPermission permission) {
    if (!hasPermission(permission)) {
      throw new ForbiddenException(INSUFFICIENT_PRIVILEGES_MESSAGE);
    }
    return this;
  }

  @Override
  public final UserSession checkComponentPermission(ProjectPermission projectPermission, ComponentDto component) {
    if (!hasComponentPermission(projectPermission, component)) {
      throw new ForbiddenException(INSUFFICIENT_PRIVILEGES_MESSAGE);
    }
    return this;

View on GitHub (pinned to 184c821202)

Solutions

1. Authenticate the request: add a valid user token via 'Authorization: Bearer <token>' or log in to get a session cookie
2. Generate a new token in My Account > Security if the old one expired or was revoked
3. If the endpoint should be public, change the code to not require login or grant appropriate anonymous permissions

Example fix

// before
curl http://sonar.example.com/api/projects/index
// after
curl -H "Authorization: Bearer squ_mytoken" http://sonar.example.com/api/projects/index

if (!userSession.isLoggedIn()) {
  throw new UnauthorizedException("Provide a valid 'Authorization: Bearer <token>' header or an active session");
}

try {
  userSession.checkLoggedIn();
  // proceed with request
} catch (UnauthorizedException e) {
  response.setHeader("WWW-Authenticate", "Bearer realm=\"sonarqube\"");
  // return 401 with guidance to authenticate
}

When it happens

Trigger: Calling any protected WebService endpoint or code path that invokes checkLoggedIn() without a valid session — anonymous request, expired/invalidated session token, or missing Authorization header.

Common situations: Expired or revoked user tokens; missing 'Authorization: Bearer <token>' header in REST calls; anonymous access attempts on endpoints without public permission; session invalidated after server restart.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Identity provider %s does not exist or is not enabled
• You're not authorized to push analysis results to the SonarQ
• Invalid personal access token
• Invalid personal access token
• Plugin [%s] does not exist

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/73a0b0d35c52e09a. Report an issue: GitHub.