{"record":{"id":"06faf1b310ad15c8","repo":"honojs/hono","slug":"no-authorization-included-in-request","errorCode":null,"errorMessage":"no authorization included in request","messagePattern":"no authorization included in request","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"src/middleware/jwk/jwk.ts","lineNumber":127,"sourceCode":"          )\n        } else {\n          token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key)\n        }\n      } else {\n        if (options.cookie.prefixOptions) {\n          token = getCookie(ctx, options.cookie.key, options.cookie.prefixOptions)\n        } else {\n          token = getCookie(ctx, options.cookie.key)\n        }\n      }\n    }\n\n    if (!token) {\n      if (options.allow_anon) {\n        return next()\n      }\n      const errDescription = 'no authorization included in request'\n      throw new HTTPException(401, {\n        message: errDescription,\n        res: unauthorizedResponse({\n          ctx,\n          error: 'invalid_request',\n          errDescription,\n          realm: options.realm,\n        }),\n      })\n    }\n\n    let payload\n    let cause\n    try {\n      const keys = typeof options.keys === 'function' ? await options.keys(ctx) : options.keys\n      const jwks_uri =\n        typeof options.jwks_uri === 'function' ? await options.jwks_uri(ctx) : options.jwks_uri\n      payload = await Jwt.verifyWithJwks(\n        token,","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/honojs/hono/blob/e2740d5a1bd0b4254e517e3af8b60789284bc7bd/src/middleware/jwk/jwk.ts#L109-L145","documentation":"The request carried no token at all (no Authorization header, or the header present but empty after parsing) and the middleware was not configured with allow_anon, so it rejects with a 401 HTTPException, error 'invalid_request', description 'no authorization included in request'.","triggerScenarios":"Any request to a jwk-protected route without an Authorization header, with an empty header value, or where the configured headerName is absent (e.g. expecting X-Auth-Token but the client sends Authorization).","commonSituations":"Public/unauthenticated pages accidentally falling under a broad app.use('/api/*', jwk(...)) mount; browser navigations that never attach Authorization; headerName mismatch after refactors; health-check probes hitting protected endpoints.","solutions":["Send the token: add 'Authorization: Bearer <jwt>' to the request","If the route should allow unauthenticated access, set allow_anon: true in the jwk options and do your own identity check downstream","Verify headerName matches what the client sends (default is Authorization)","Narrow the middleware mount so only truly protected routes require tokens"],"exampleFix":"// before\napp.use('/api/*', jwk({ jwks_uri }))\n// after\napp.use('/api/*', jwk({ jwks_uri, allow_anon: true }))","handlingStrategy":"validation","validationCode":"const hasToken = (req: Request): boolean => {\n  const h = req.headers.get('Authorization')\n  return !!h && /^bearer\\s+\\S+$/i.test(h)\n}","typeGuard":"const requestHasBearer = (req: Request): boolean => {\n  const parts = (req.headers.get('Authorization') || '').split(/\\s+/)\n  return parts.length === 2 && parts[0].toLowerCase() === 'bearer' && !!parts[1]\n}","tryCatchPattern":"try { await protectedCall() } catch (e) { if (e instanceof HTTPException && e.status === 401) { /* redirect to login: no token present */ } }","preventionTips":["Set allow_anon: true only on routes that genuinely permit anonymous access","Mount jwk() narrowly on protected path prefixes, not app-wide","Ensure clients attach the Authorization header on every protected request","Confirm headerName matches between client and middleware"],"tags":["jwk","jwt","http-401","missing-header","auth"],"backgroundTag":"missing-authorization-header","analyzedSha":"e2740d5a1bd0b4254e517e3af8b60789284bc7bd","analyzedAt":"2026-08-28T10:18:08.750Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}