{"record":{"id":"85e512453af3acd0","repo":"micro/go-micro","slug":"missing-authorization-token-in-metadata","errorCode":null,"errorMessage":"missing authorization token in metadata","messagePattern":"missing authorization token in metadata","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"wrapper/auth/metadata.go","lineNumber":20,"sourceCode":"\nimport (\n\t\"errors\"\n\t\"strings\"\n\n\t\"go-micro.dev/v6/auth\"\n\t\"go-micro.dev/v6/metadata\"\n)\n\nconst (\n\t// MetadataKeyAuthorization is the key for the Authorization header in metadata\n\tMetadataKeyAuthorization = \"Authorization\"\n\t// BearerPrefix is the prefix for Bearer tokens\n\tBearerPrefix = \"Bearer \"\n)\n\nvar (\n\t// ErrMissingToken is returned when no authorization token is found in metadata\n\tErrMissingToken = errors.New(\"missing authorization token in metadata\")\n\t// ErrInvalidToken is returned when the token format is invalid\n\tErrInvalidToken = errors.New(\"invalid token format, expected 'Bearer <token>'\")\n)\n\n// TokenFromMetadata extracts the Bearer token from request metadata.\n// Returns the token string without the \"Bearer \" prefix, or an error if not found.\nfunc TokenFromMetadata(md metadata.Metadata) (string, error) {\n\t// Check for Authorization header\n\tauthHeader, ok := md.Get(MetadataKeyAuthorization)\n\tif !ok {\n\t\t// Also check lowercase version\n\t\tauthHeader, ok = md.Get(strings.ToLower(MetadataKeyAuthorization))\n\t\tif !ok {\n\t\t\treturn \"\", ErrMissingToken\n\t\t}\n\t}\n\n\t// Verify Bearer prefix","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/micro/go-micro/blob/24529f140421a11a33b6999ab7944f2021cfd69c/wrapper/auth/metadata.go#L2-L38","documentation":"ErrMissingToken is returned by TokenFromMetadata (and via AccountFromMetadata) when the request metadata contains no Authorization header — checked under both 'Authorization' and 'authorization' keys. The library cannot authenticate the caller because no credential was forwarded.","triggerScenarios":"Calling TokenFromMetadata(md) where md lacks the Authorization key; a client wrapper (auth wrapper) not configured to inject the token; an inbound request that dropped metadata during proxying or broker hops.","commonSituations":"Client built without the auth wrapper so the Bearer header is never set; gateway stripping Authorization before forwarding; metadata key spelled differently (e.g. custom casing not covered by the two lookups); unauthenticated probes hitting protected endpoints.","solutions":["Set the header before sending: use auth.TokenToMetadata(md, token) or the auth client wrapper so Authorization: Bearer <token> is attached","Verify intermediate services/proxies propagate metadata keys unchanged","Call TokenToMetadata with a non-empty token in tests/tools that exercise protected endpoints"],"exampleFix":"// before\nres, err := client.Call(ctx, req) // no auth metadata\n// after\nmd := auth.TokenToMetadata(metadata.Metadata{}, token)\nctx = metadata.NewContext(ctx, md)\nres, err := client.Call(ctx, req)","handlingStrategy":"try-catch","validationCode":"func hasAuthHeader(md metadata.Metadata) bool {\n\t_, ok := md.Get(\"Authorization\")\n\tif !ok {\n\t\t_, ok = md.Get(\"authorization\")\n\t}\n\treturn ok\n}\n// if !hasAuthHeader(md) { md = auth.TokenToMetadata(md, token) }","typeGuard":"func isMissingToken(err error) bool { return errors.Is(err, auth.ErrMissingToken) }","tryCatchPattern":"token, err := auth.TokenFromMetadata(md)\nif errors.Is(err, auth.ErrMissingToken) {\n\treturn errors.New(\"unauthorized: no bearer token supplied\") // 401 response\n}","preventionTips":["Always attach tokens with auth.TokenToMetadata or the auth client wrapper","Verify proxies/gateways forward the Authorization metadata key","Test unauthenticated requests explicitly to confirm 401 handling","Standardize on exact 'Authorization'/'authorization' key casing"],"tags":["auth","metadata","bearer-token","missing-header"],"backgroundTag":"missing-authorization-header","analyzedSha":"24529f140421a11a33b6999ab7944f2021cfd69c","analyzedAt":"2026-09-01T02:52:24.923Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}