{"record":{"id":"47cde016e0ce80b6","repo":"thephpleague/oauth2-server","slug":"missing-bearer-token","errorCode":null,"errorMessage":"Missing \"Bearer\" token","messagePattern":"Missing \"Bearer\" token","errorType":"http","errorClass":"OAuthServerException","httpStatus":401,"severity":"error","filePath":"src/AuthorizationValidators/BearerTokenValidator.php","lineNumber":106,"sourceCode":"                InMemory::plainText($publicKeyContents, $this->publicKey->getPassPhrase() ?? '')\n            )\n        );\n    }\n\n    /**\n     * {@inheritdoc}\n     */\n    public function validateAuthorization(ServerRequestInterface $request): ServerRequestInterface\n    {\n        if ($request->hasHeader('authorization') === false) {\n            throw OAuthServerException::accessDenied('Missing \"Authorization\" header');\n        }\n\n        $header = $request->getHeader('authorization');\n        $jwt = trim((string) preg_replace('/^\\s*Bearer\\s/i', '', $header[0]));\n\n        if ($jwt === '') {\n            throw OAuthServerException::accessDenied('Missing \"Bearer\" token');\n        }\n\n        try {\n            // Attempt to parse the JWT\n            $token = $this->jwtConfiguration->parser()->parse($jwt);\n        } catch (Exception $exception) {\n            throw OAuthServerException::accessDenied($exception->getMessage(), null, $exception);\n        }\n\n        try {\n            // Attempt to validate the JWT\n            $constraints = $this->jwtConfiguration->validationConstraints();\n            $this->jwtConfiguration->validator()->assert($token, ...$constraints);\n        } catch (RequiredConstraintsViolated $exception) {\n            throw OAuthServerException::accessDenied('Access token could not be verified', null, $exception);\n        }\n\n        if (!$token instanceof UnencryptedToken) {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/thephpleague/oauth2-server/blob/9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c/src/AuthorizationValidators/BearerTokenValidator.php#L88-L124","documentation":"Generic guard inside validateAuthorization(): after stripping the optional case-insensitive \"Bearer \" prefix from the Authorization header, the remaining JWT credential is empty. This fires when a client sends a syntactically present but credential-less header, e.g. \"Authorization: Bearer\" or \"Bearer   \" — the header exists yet carries no actual access token to parse.","triggerScenarios":"Header like 'Authorization: Bearer ' (empty token) or 'Authorization: Basic abc123' where the regex strips nothing but the leftover is empty, or header is only whitespace.","commonSituations":"Client sends empty token variable in template interpolation ('Bearer {$token}'); wrong scheme (Basic vs Bearer); header set to 'Bearer' with no space/value.","solutions":["Ensure the header is 'Authorization: Bearer <non-empty JWT>'.","Check the token variable isn't empty/null at the call site.","Verify only one Authorization header is set (later headers can confuse getHeader()[0])."],"exampleFix":"// before\n$request = $request->withHeader('Authorization', 'Bearer ' . $maybeNullToken);\n// after\nif ($maybeNullToken !== null && $maybeNullToken !== '') {\n    $request = $request->withHeader('Authorization', 'Bearer ' . $maybeNullToken);\n}","handlingStrategy":"validation","validationCode":"$header = $request->getHeaderLine('Authorization');\nif (!preg_match('/^Bearer\\s+\\S+/i', $header)) {\n    throw new \\RuntimeException('Authorization header must be \"Bearer <token>\"');\n}","typeGuard":null,"tryCatchPattern":"try { $request = $validator->validateAuthorization($request); } catch (OAuthServerException $e) { return $e->generateHttpResponse(new Response(), 401); }","preventionTips":["Null-check the token variable before interpolating it into the header","Use one token-storage accessor that never returns empty strings to header code"],"tags":["oauth","bearer-token","empty-value"],"backgroundTag":"empty-required-field","analyzedSha":"9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c","analyzedAt":"2026-09-15T22:33:30.452Z","contentChangedAt":"2026-09-15T22:33:30.452Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}