{"record":{"id":"3ced9e53f094a4db","repo":"bytedance/deer-flow","slug":"not-authenticated","errorCode":"NOT_AUTHENTICATED","errorMessage":"Not authenticated","messagePattern":"Not authenticated","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"backend/app/gateway/deps.py","lineNumber":755,"sourceCode":"    Raises HTTPException 401 if not authenticated.\n    \"\"\"\n    state = getattr(request, \"state\", None)\n    state_user = getattr(state, \"user\", None)\n    from app.gateway.auth_disabled import AUTH_SOURCE_AUTH_DISABLED, AUTH_SOURCE_INTERNAL, AUTH_SOURCE_SESSION\n\n    if state_user is not None and getattr(state, \"auth_source\", None) in {\n        AUTH_SOURCE_SESSION,\n        AUTH_SOURCE_AUTH_DISABLED,\n        AUTH_SOURCE_INTERNAL,\n    }:\n        return state_user\n\n    from app.gateway.auth import decode_token\n    from app.gateway.auth.errors import AuthErrorCode, AuthErrorResponse, TokenError, token_error_to_code\n\n    access_token = request.cookies.get(\"access_token\")\n    if not access_token:\n        raise HTTPException(\n            status_code=401,\n            detail=AuthErrorResponse(code=AuthErrorCode.NOT_AUTHENTICATED, message=\"Not authenticated\").model_dump(),\n        )\n\n    payload = decode_token(access_token)\n    if isinstance(payload, TokenError):\n        raise HTTPException(\n            status_code=401,\n            detail=AuthErrorResponse(code=token_error_to_code(payload), message=f\"Token error: {payload.value}\").model_dump(),\n        )\n\n    provider = get_local_provider()\n    user = await provider.get_user(payload.sub)\n    if user is None:\n        raise HTTPException(\n            status_code=401,\n            detail=AuthErrorResponse(code=AuthErrorCode.USER_NOT_FOUND, message=\"User not found\").model_dump(),\n        )","sourceCodeStart":737,"sourceCodeEnd":773,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/deps.py#L737-L773","documentation":"HTTP 401 with code NOT_AUTHENTICATED from get_current_user_from_request(). The function first trusts request.state.user set by AuthMiddleware (session, auth-disabled, or internal source); otherwise it reads the access_token cookie and raises this when the cookie is absent or empty. The response detail is an AuthErrorResponse payload, not a plain string.","triggerScenarios":"Any authenticated Gateway API call made without an access_token cookie and without AuthMiddleware having stamped request.state.user — e.g. curl without cookies, expired/cleared session, browser fetch from a different origin that excludes credentials, or calling before login.","commonSituations":"Session cookie expired and the client did not refresh it; front-end fetch missing credentials: 'include' when hitting the proxy from another origin; scripts that use an Authorization header (not supported here — auth is cookie-based); logout in another tab clearing the cookie.","solutions":["Log in via the auth flow to obtain a fresh access_token cookie, then retry with the cookie jar attached","For fetch/XHR from a browser, send credentials: 'include' (same-origin via the nginx proxy usually works by default)","If scripting, capture cookies from the login response (curl -c jar) and reuse them (curl -b jar)","If you expected AuthMiddleware to have authenticated the request, verify auth is not failing earlier (session store down, auth disabled flag changed)"],"exampleFix":"// before (browser)\nawait fetch('/api/threads', { headers: { 'Authorization': 'Bearer xxx' } }); // 401 — auth is cookie-based\n// after\nawait fetch('/api/threads', { credentials: 'include' });","handlingStrategy":"validation","validationCode":"function hasSessionCookie(): boolean {\n  return document.cookie.includes('access_token=');\n}\nif (!hasSessionCookie()) redirect('/login'); // before any authenticated fetch","typeGuard":"null","tryCatchPattern":"try:\n    data = await api.get('/api/threads')\nexcept HTTPError as e:\n    if e.status === 401 && e.detail?.code === 'NOT_AUTHENTICATED':\n        redirect('/login'); return;\n    throw e;","preventionTips":["Centralize fetch in one client that attaches credentials and handles 401 -> re-login","Always send credentials: 'include' on cross-origin API calls","Check for the access_token cookie before rendering authenticated UI"],"tags":["auth","http-401","cookies","session","gateway"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}