{"record":{"id":"356e1d8cb7b6b325","repo":"plandex-ai/plandex","slug":"error-getting-auth-header","errorCode":null,"errorMessage":"error getting auth header","messagePattern":"error getting auth header","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"app/server/handlers/auth_helpers.go","lineNumber":471,"sourceCode":"\t}\n\n\tif semver.Compare(version, minVersion) < 0 {\n\t\thttp.Error(w, msg, http.StatusBadRequest)\n\t\treturn false\n\t}\n\n\treturn true\n}\n\nfunc execAuthenticate(w http.ResponseWriter, r *http.Request, requireOrg bool, raiseErr bool) *types.ServerAuth {\n\tlog.Println(\"authenticating request\")\n\n\tparsed, err := GetAuthHeader(r)\n\n\tif err != nil {\n\t\tlog.Printf(\"error getting auth header: %v\\n\", err)\n\t\tif raiseErr {\n\t\t\thttp.Error(w, \"error getting auth header\", http.StatusInternalServerError)\n\t\t}\n\t\treturn nil\n\t}\n\n\tif parsed == nil {\n\t\tlog.Println(\"no auth header\")\n\t\tif raiseErr {\n\t\t\thttp.Error(w, \"no auth header\", http.StatusUnauthorized)\n\t\t}\n\t\treturn nil\n\t}\n\n\t// validate the token\n\tauthToken, err := db.ValidateAuthToken(parsed.Token)\n\n\tif err != nil {\n\t\tlog.Printf(\"error validating auth token: %v\\n\", err)\n","sourceCodeStart":453,"sourceCodeEnd":489,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/auth_helpers.go#L453-L489","documentation":"execAuthenticate failed to read or parse the Authorization header via GetAuthHeader and logs 'error getting auth header'. When raiseErr is true (Authenticate, not AuthenticateOptional) it responds with HTTP 500. It indicates a malformed or unreadable auth header, not necessarily a missing one.","triggerScenarios":"Requests with a missing or malformed Authorization header (wrong scheme, non-Bearer format) hitting endpoints wrapped by Authenticate. AuthenticateOptional also calls this path but suppresses the HTTP error.","commonSituations":"Clients forgetting to attach the token, proxies/gateways stripping the Authorization header, hand-rolled headers not matching Bearer format expected by GetAuthHeader.","solutions":["Ensure the client sends 'Authorization: Bearer <token>' on every authenticated request","Verify no reverse proxy or middleware strips or rewrites the Authorization header","Check GetAuthHeader's parsing logic matches the header format your client sends","If the request is meant to be anonymous, use AuthenticateOptional instead of Authenticate"],"exampleFix":"// before\nreq.Header.Set(\"Token\", token) // wrong header\n// after\nreq.Header.Set(\"Authorization\", \"Bearer \"+token)","handlingStrategy":"try-catch","validationCode":"if req.Header.Get(\"Authorization\") == \"\" {\n\treturn fmt.Errorf(\"request missing Authorization header\")\n}","typeGuard":null,"tryCatchPattern":"user, err := client.AuthenticatedUser(req)\nif err != nil {\n\tvar apiErr *APIError\n\tif errors.As(err, &apiErr) && apiErr.StatusCode == 500 && strings.Contains(apiErr.Message, \"auth header\") {\n\t\tlog.Println(\"malformed auth header; fix header format\")\n\t\treturn nil\n\t}\n\treturn err\n}","preventionTips":["Use a shared auth interceptor that always sets 'Authorization: Bearer <token>'","Check proxies/middleware don't strip the Authorization header","Verify header format matches GetAuthHeader's expected scheme","Use AuthenticateOptional for endpoints where anonymous access is allowed"],"tags":["http","auth","headers"],"backgroundTag":"missing-authorization-header","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}