{"record":{"id":"89e69472228a29b5","repo":"yudai/gotty","slug":"bad-request","errorCode":null,"errorMessage":"Bad Request","messagePattern":"Bad Request","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"server/middleware.go","lineNumber":32,"sourceCode":"\t\tlog.Printf(\"%s %d %s %s\", r.RemoteAddr, rw.status, r.Method, r.URL.Path)\n\t})\n}\n\nfunc (server *Server) wrapHeaders(handler http.Handler) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\t// todo add version\n\t\tw.Header().Set(\"Server\", \"GoTTY\")\n\t\thandler.ServeHTTP(w, r)\n\t})\n}\n\nfunc (server *Server) wrapBasicAuth(handler http.Handler, credential string) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\ttoken := strings.SplitN(r.Header.Get(\"Authorization\"), \" \", 2)\n\n\t\tif len(token) != 2 || strings.ToLower(token[0]) != \"basic\" {\n\t\t\tw.Header().Set(\"WWW-Authenticate\", `Basic realm=\"GoTTY\"`)\n\t\t\thttp.Error(w, \"Bad Request\", http.StatusUnauthorized)\n\t\t\treturn\n\t\t}\n\n\t\tpayload, err := base64.StdEncoding.DecodeString(token[1])\n\t\tif err != nil {\n\t\t\thttp.Error(w, \"Internal Server Error\", http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\n\t\tif credential != string(payload) {\n\t\t\tw.Header().Set(\"WWW-Authenticate\", `Basic realm=\"GoTTY\"`)\n\t\t\thttp.Error(w, \"authorization failed\", http.StatusUnauthorized)\n\t\t\treturn\n\t\t}\n\n\t\tlog.Printf(\"Basic Authentication Succeeded: %s\", r.RemoteAddr)\n\t\thandler.ServeHTTP(w, r)\n\t})","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/yudai/gotty/blob/a080c85cbc59226c94c6941ad8c395232d72d517/server/middleware.go#L14-L50","documentation":"Basic-auth middleware rejection (StatusUnauthorized/Bad Request class): the Authorization header is missing or not shaped as '<scheme> <token>' — the split produces fewer than 2 parts — so the request never reaches the wrapped handler. It guards credential checks, firing on malformed headers before credential comparison.","triggerScenarios":"Thrown at server/middleware.go:32 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Send 'Authorization: Basic <base64(user:pass)>' (or the expected scheme) on every request","Fix clients that send bare tokens without the scheme prefix","Return 401 with WWW-Authenticate so browsers prompt correctly"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a080c85cbc59226c94c6941ad8c395232d72d517","analyzedAt":"2026-09-02T16:42:38.150Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}