{"record":{"id":"73a0b0d35c52e09a","repo":"SonarSource/sonarqube","slug":"authentication-is-required","errorCode":null,"errorMessage":"Authentication is required","messagePattern":"Authentication is required","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java","lineNumber":171,"sourceCode":"    return entities.stream()\n      .filter(c -> (allowPublicComponent && !c.isPrivate()) || hasEntityPermission(permission, c.getUuid()))\n      .toList();\n  }\n\n  /**\n   * Naive implementation, to be overridden if needed\n   */\n  protected List<ComponentDto> doKeepAuthorizedComponents(ProjectPermission permission, Collection<ComponentDto> components) {\n    boolean allowPublicComponent = ProjectPermission.PUBLIC_PERMISSIONS.contains(permission);\n    return components.stream()\n      .filter(c -> (allowPublicComponent && !c.isPrivate()) || hasComponentPermission(permission, c))\n      .toList();\n  }\n\n  @Override\n  public final UserSession checkLoggedIn() {\n    if (!isLoggedIn()) {\n      throw new UnauthorizedException(AUTHENTICATION_IS_REQUIRED_MESSAGE);\n    }\n    return this;\n  }\n\n  @Override\n  public final UserSession checkPermission(GlobalPermission permission) {\n    if (!hasPermission(permission)) {\n      throw new ForbiddenException(INSUFFICIENT_PRIVILEGES_MESSAGE);\n    }\n    return this;\n  }\n\n  @Override\n  public final UserSession checkComponentPermission(ProjectPermission projectPermission, ComponentDto component) {\n    if (!hasComponentPermission(projectPermission, component)) {\n      throw new ForbiddenException(INSUFFICIENT_PRIVILEGES_MESSAGE);\n    }\n    return this;","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java#L153-L189","documentation":"AbstractUserSession.checkLoggedIn throws UnauthorizedException when the current session has no authenticated user. It is the standard guard enforcing that a web service or action requires an authenticated session before proceeding.","triggerScenarios":"Calling any protected WebService endpoint or code path that invokes checkLoggedIn() without a valid session — anonymous request, expired/invalidated session token, or missing Authorization header.","commonSituations":"Expired or revoked user tokens; missing 'Authorization: Bearer <token>' header in REST calls; anonymous access attempts on endpoints without public permission; session invalidated after server restart.","solutions":["Authenticate the request: add a valid user token via 'Authorization: Bearer <token>' or log in to get a session cookie","Generate a new token in My Account > Security if the old one expired or was revoked","If the endpoint should be public, change the code to not require login or grant appropriate anonymous permissions"],"exampleFix":"// before\ncurl http://sonar.example.com/api/projects/index\n// after\ncurl -H \"Authorization: Bearer squ_mytoken\" http://sonar.example.com/api/projects/index","handlingStrategy":"try-catch","validationCode":"if (!userSession.isLoggedIn()) {\n  throw new UnauthorizedException(\"Provide a valid 'Authorization: Bearer <token>' header or an active session\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  userSession.checkLoggedIn();\n  // proceed with request\n} catch (UnauthorizedException e) {\n  response.setHeader(\"WWW-Authenticate\", \"Bearer realm=\\\"sonarqube\\\"\");\n  // return 401 with guidance to authenticate\n}","preventionTips":["Always send the Authorization header with a valid token in scripts/CI","Rotate and re-create tokens before expiry; store them in env vars, not in code","Verify session validity before long-running operations; re-authenticate after server restarts"],"tags":["java","authentication","unauthorized","sonarqube"],"backgroundTag":"authentication-required","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}