{"record":{"id":"64ad1f78d364dc71","repo":"laravel/framework","slug":"invalid-credentials","errorCode":null,"errorMessage":"Invalid credentials.","messagePattern":"Invalid credentials\\.","errorType":"http","errorClass":"UnauthorizedHttpException","httpStatus":401,"severity":"error","filePath":"src/Illuminate/Auth/SessionGuard.php","lineNumber":409,"sourceCode":"     * @param  \\Symfony\\Component\\HttpFoundation\\Request  $request\n     * @param  string  $field\n     * @return array\n     */\n    protected function basicCredentials(Request $request, $field)\n    {\n        return [$field => $request->getUser(), 'password' => $request->getPassword()];\n    }\n\n    /**\n     * Get the response for basic authentication.\n     *\n     * @return void\n     *\n     * @throws \\Symfony\\Component\\HttpKernel\\Exception\\UnauthorizedHttpException\n     */\n    protected function failedBasicResponse()\n    {\n        throw new UnauthorizedHttpException('Basic', 'Invalid credentials.');\n    }\n\n    /**\n     * Attempt to authenticate a user using the given credentials.\n     *\n     * @param  array  $credentials\n     * @param  bool  $remember\n     * @return bool\n     */\n    public function attempt(#[\\SensitiveParameter] array $credentials = [], $remember = false)\n    {\n        return $this->timebox->call(function ($timebox) use ($credentials, $remember) {\n            $this->fireAttemptEvent($credentials, $remember);\n\n            $this->lastAttempted = $user = $this->provider->retrieveByCredentials($credentials);\n\n            // If an implementation of UserInterface was returned, we'll ask the provider\n            // to validate the user against the given credentials, and if they are in","sourceCodeStart":391,"sourceCodeEnd":427,"githubUrl":"https://github.com/laravel/framework/blob/e0f6eb3518ac29fbbca8529e97d0df7fc9f24481/src/Illuminate/Auth/SessionGuard.php#L391-L427","documentation":"Thrown by SessionGuard::failedBasicResponse() as a Symfony UnauthorizedHttpException('Basic', ...) when HTTP Basic authentication credentials provided in the request are empty or invalid. It triggers the browser's native 401 WWW-Authenticate: Basic challenge.","triggerScenarios":"A route guarded by the 'auth.basic' middleware receives a request with missing/incorrect Authorization: Basic <base64(user:pass)> header, or credentials that fail the provider's retrieval+hash check.","commonSituations":"Stateless HTTP Basic-protected endpoints (e.g. internal admin tools) hit without credentials; typos in the username/password; cached wrong credentials in the browser; stateful sessions bypassed because auth.basic always re-checks the header.","solutions":["Provide a valid username and password via the Basic auth header for the protected route.","If using a different identifier field, set 'basic' username field via Auth::basic()->username or the guard config.","Verify the user exists and the password hash matches using Hash::check.","Switch the route to a session-based 'auth' middleware if stateless Basic is not desired."],"exampleFix":"// before — no credentials\n$response = Http::get('https://app.test/api/protected'); // UnauthorizedHttpException\n\n// after — supply Basic credentials\n$response = Http::withBasicAuth('user@example.com', 'secret')->get('https://app.test/api/protected');","handlingStrategy":"try-catch","validationCode":"// PHP — validate basic credentials before the middleware check\n[$user, $pass] = [$request->getUser(), $request->getPassword()];\nif ($user === null || $pass === null || ! Auth::validate([$basicField ?? 'email' => $user, 'password' => $pass])) {\n    return response()->json(['message' => 'Invalid credentials.'], 401);\n}","typeGuard":"// HTTP-level guard: ensure Authorization header present and decodable\nfunction hasBasicCredentials(\\Illuminate\\Http\\Request $r): bool {\n    return $r->getUser() !== null && $r->getPassword() !== null;\n}","tryCatchPattern":"try {\n    // route with auth.basic middleware\n} catch (\\Symfony\\Component\\HttpKernel\\Exception\\UnauthorizedHttpException $e) {\n    return response()->json(['message' => 'Invalid credentials.'], 401);\n}","preventionTips":["Send valid Basic credentials on auth.basic routes.","Confirm the configured username field (email vs username).","Avoid Basic auth for end-user-facing routes; use session or token auth."],"tags":["authentication","http-basic","laravel","http"],"backgroundTag":null,"analyzedSha":"e0f6eb3518ac29fbbca8529e97d0df7fc9f24481","analyzedAt":"2026-08-11T20:52:37.562Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}