{"record":{"id":"8750cde7028b7f25","repo":"ruvnet/RuView","slug":"jwt-authentication-is-not-configured-in-developme","errorCode":null,"errorMessage":"JWT authentication is not configured. In development mode, either disable authentication (enable_authentication=False) or configure JWT validation. Returning mock users is not permitted in any environment.","messagePattern":"JWT authentication is not configured\\. In development mode, either disable authentication \\(enable_authentication=False\\) or configure JWT validation\\. Returning mock users is not permitted in any environment\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"archive/v1/src/api/dependencies.py","lineNumber":90,"sourceCode":"    \n    # Check if user is already set by middleware\n    if hasattr(request.state, 'user') and request.state.user:\n        return request.state.user\n    \n    # No credentials provided\n    if not credentials:\n        return None\n    \n    # Validate the JWT token\n    # JWT validation must be configured via settings (e.g. JWT_SECRET, JWT_ALGORITHM)\n    if settings.is_development:\n        logger.warning(\n            \"Authentication credentials provided in development mode but JWT \"\n            \"validation is not configured. Set up JWT authentication via \"\n            \"environment variables (JWT_SECRET, JWT_ALGORITHM) or disable \"\n            \"authentication. Rejecting request.\"\n        )\n        raise HTTPException(\n            status_code=status.HTTP_401_UNAUTHORIZED,\n            detail=(\n                \"JWT authentication is not configured. In development mode, either \"\n                \"disable authentication (enable_authentication=False) or configure \"\n                \"JWT validation. Returning mock users is not permitted in any environment.\"\n            ),\n            headers={\"WWW-Authenticate\": \"Bearer\"},\n        )\n\n    # In production, implement proper JWT validation\n    raise HTTPException(\n        status_code=status.HTTP_401_UNAUTHORIZED,\n        detail=(\n            \"JWT authentication is not configured. Configure JWT_SECRET and \"\n            \"JWT_ALGORITHM environment variables, or integrate an external \"\n            \"identity provider. See docs/authentication.md for setup instructions.\"\n        ),\n        headers={\"WWW-Authenticate\": \"Bearer\"},","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/ruvnet/RuView/blob/4685618388a5e49fad5b3005806f3bdd6a7c25c3/archive/v1/src/api/dependencies.py#L72-L108","documentation":"FastAPI dependency get_current_user raises 401 with this message when the request carries Authorization credentials, settings.is_development is true, but JWT validation is not configured (JWT_SECRET/JWT_ALGORITHM unset). The code deliberately refuses to return mock users in any environment, so dev mode with credentials present but no JWT setup is rejected.","triggerScenarios":"Dev server started with authentication enabled and JWT_SECRET unset while the client sends an Authorization: Bearer header; a browser or API client replaying a token saved from another environment against a fresh dev setup.","commonSituations":"Copying a .env template without filling the JWT secrets; frontend auto-attaching a stale token; flipping enable_authentication to true in dev without completing JWT configuration.","solutions":["For pure local development, set enable_authentication=False so credentials are not required at all","Or configure JWT_SECRET and JWT_ALGORITHM environment variables for the dev server and restart it","Clear the stale bearer token the client is sending (logout / clear local storage)","Follow docs/authentication.md referenced by the sibling production message"],"exampleFix":"# before: dev server with auth enabled but no secrets\n# enable_authentication=True, JWT_SECRET unset -> 401\n\n# after (option A): disable auth in dev\nexport ENABLE_AUTHENTICATION=false\n\n# after (option B): configure JWT\nexport JWT_SECRET=$(openssl rand -hex 32)\nexport JWT_ALGORITHM=HS256","handlingStrategy":"validation","validationCode":"# Fail fast at startup instead of per-request 401s\nfrom src.api.dependencies import get_settings\ns = get_settings()\nif s.enable_authentication and not s.is_development and not (s.jwt_secret and s.jwt_algorithm):\n    raise RuntimeError('JWT_SECRET/JWT_ALGORITHM required when authentication is enabled')","typeGuard":null,"tryCatchPattern":"try:\n    resp = client.get('/api/protected', headers={'Authorization': f'Bearer {token}'})\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 401 and 'JWT authentication is not configured' in e.response.text:\n        # dev environment misconfiguration: fix server env, not the token\n        raise SystemExit('Configure JWT_SECRET or set enable_authentication=False')\n    raise","preventionTips":["Keep a checked-in dev .env.example with JWT_SECRET/JWT_ALGORITHM placeholders","Clear stored bearer tokens when switching environments","Prefer enable_authentication=False for local work that does not exercise auth paths"],"tags":["authentication","jwt","fastapi","python","configuration"],"backgroundTag":null,"analyzedSha":"4685618388a5e49fad5b3005806f3bdd6a7c25c3","analyzedAt":"2026-08-16T06:09:40.886Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}