{"record":{"id":"31273ffd3e740167","repo":"Mintplex-Labs/anything-llm","slug":"invalid-auth-credentials","errorCode":null,"errorMessage":"Invalid auth credentials.","messagePattern":"Invalid auth credentials\\.","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"server/utils/middleware/validatedRequest.js","lineNumber":64,"sourceCode":"  if (p === null || !/\\w{32}:\\w{32}/.test(p)) {\n    response.status(401).json({\n      error: \"Token expired or failed validation.\",\n    });\n    return;\n  }\n\n  // Since the blame of this comment we have been encrypting the `p` property of JWTs with the persistent\n  // encryptionManager PEM's. This prevents us from storing the `p` unencrypted in the JWT itself, which could\n  // be unsafe. As a consequence, existing JWTs with invalid `p` values that do not match the regex\n  // in ln:44 will be marked invalid so they can be logged out and forced to log back in and obtain an encrypted token.\n  // This kind of methodology only applies to single-user password mode.\n  if (\n    !bcrypt.compareSync(\n      EncryptionMgr.decrypt(p),\n      bcrypt.hashSync(process.env.AUTH_TOKEN, 10)\n    )\n  ) {\n    response.status(401).json({\n      error: \"Invalid auth credentials.\",\n    });\n    return;\n  }\n\n  UserMetaCache.setFromRequest(request);\n  next();\n}\n\nasync function validateMultiUserRequest(request, response, next) {\n  const auth = request.header(\"Authorization\");\n  const token = auth ? auth.split(\" \")[1] : null;\n\n  if (!token) {\n    response.status(401).json({\n      error: \"No auth token found.\",\n    });\n    return;","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/utils/middleware/validatedRequest.js#L46-L82","documentation":"Credential guard in validatedRequest (single-user mode): the token's decrypted p payload did not match the stored AUTH_TOKEN credentials via bcrypt, so the presented credentials are wrong and the request is refused with 401.","triggerScenarios":"Invalid auth credentials supplied. Triggered when credential validation fails during login/token exchange (validatedRequest.js:64).","commonSituations":"See trigger scenarios.","solutions":["The token does not match AUTH_TOKEN — log in again with the correct password.","Verify AUTH_TOKEN on the server was not changed since the token was issued; if it was, all users must re-authenticate."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}