{"record":{"id":"72d547d4fd0e4380","repo":"wg-easy/wg-easy","slug":"bearer-auth-required","errorCode":null,"errorMessage":"Bearer Auth required","messagePattern":"Bearer Auth required","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"src/server/utils/handler.ts","lineNumber":161,"sourceCode":"  handler: MetricsHandler<TReq, TRes>\n) => {\n  return defineEventHandler(async (event) => {\n    const metricsConfig = await Database.general.getMetricsConfig();\n\n    if (metricsConfig.password) {\n      const auth = getHeader(event, 'Authorization');\n\n      if (!auth) {\n        throw createError({\n          statusCode: 401,\n          statusMessage: 'Unauthorized',\n        });\n      }\n\n      const [method, value] = auth.split(' ');\n\n      if (method !== 'Bearer' || !value) {\n        throw createError({\n          statusCode: 401,\n          statusMessage: 'Bearer Auth required',\n        });\n      }\n\n      const tokenValid = await isPasswordValid(value, metricsConfig.password);\n\n      if (!tokenValid) {\n        throw createError({\n          statusCode: 401,\n          statusMessage: 'Incorrect token',\n        });\n      }\n    }\n\n    if (metricsConfig[type] !== true) {\n      throw createError({\n        statusCode: 400,","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/wg-easy/wg-easy/blob/5c38c1427a0c6c62f1bbc6724233a71d931ac431/src/server/utils/handler.ts#L143-L179","documentation":"Thrown when an Authorization header is present but is not a Bearer token (scheme other than 'Bearer' or empty value). HTTP 401 — metrics endpoints require Bearer authentication.","triggerScenarios":"Sending `Authorization: Basic ...` or a bare token without the 'Bearer ' prefix to a password-protected metrics endpoint; a header like 'Bearer' with no token after it.","commonSituations":"Scrape tools sending Basic auth by default, misconfigured monitors using 'Token' or custom schemes, copying only the password without the Bearer prefix.","solutions":["Use exactly `Authorization: Bearer <metrics-password>` (capital B, single space)","Change your client's auth scheme from Basic/custom to Bearer","Ensure the token value is non-empty after trimming","Verify the header is not encoded/mangled by an intermediate proxy"],"exampleFix":"// before\nheaders: { Authorization: metricsPassword }\n// after\nheaders: { Authorization: `Bearer ${metricsPassword}` }","handlingStrategy":"type-guard","validationCode":"const auth = `Bearer ${token}`;\nif (!/^Bearer \\S+$/.test(auth)) throw new Error('Use Bearer scheme');","typeGuard":"function isBearerHeader(v) { const [m, val] = (v ?? '').split(' '); return m === 'Bearer' && !!val; }","tryCatchPattern":"try {\n  return await fetchMetrics();\n} catch (e) {\n  if (e.statusCode === 401 && e.statusMessage === 'Bearer Auth required') {\n    // fix scheme: use 'Authorization: Bearer <token>'\n  }\n  throw e;\n}","preventionTips":["Always prefix the token with 'Bearer ' and a single space","Don't use Basic or custom auth schemes for metrics endpoints","Assert header format in client-side tests"],"tags":["auth","http-401","bearer","metrics"],"backgroundTag":"malformed-authorization-header","analyzedSha":"5c38c1427a0c6c62f1bbc6724233a71d931ac431","analyzedAt":"2026-08-30T04:35:56.098Z","schemaVersion":2},"datasetVersion":"2026-08-30T08:17:16.595Z"}