{"record":{"id":"8ac3363a2aaf0b13","repo":"thephpleague/oauth2-server","slug":"missing-authorization-header","errorCode":null,"errorMessage":"Missing \"Authorization\" header","messagePattern":"Missing \"Authorization\" header","errorType":"http","errorClass":"OAuthServerException","httpStatus":401,"severity":"error","filePath":"src/AuthorizationValidators/BearerTokenValidator.php","lineNumber":99,"sourceCode":"        }\n\n        // TODO: next major release: replace deprecated method and remove phpstan ignored error\n        $this->jwtConfiguration->setValidationConstraints(\n            new LooseValidAt($clock, $this->jwtValidAtDateLeeway),\n            new SignedWith(\n                new Sha256(),\n                InMemory::plainText($publicKeyContents, $this->publicKey->getPassPhrase() ?? '')\n            )\n        );\n    }\n\n    /**\n     * {@inheritdoc}\n     */\n    public function validateAuthorization(ServerRequestInterface $request): ServerRequestInterface\n    {\n        if ($request->hasHeader('authorization') === false) {\n            throw OAuthServerException::accessDenied('Missing \"Authorization\" header');\n        }\n\n        $header = $request->getHeader('authorization');\n        $jwt = trim((string) preg_replace('/^\\s*Bearer\\s/i', '', $header[0]));\n\n        if ($jwt === '') {\n            throw OAuthServerException::accessDenied('Missing \"Bearer\" token');\n        }\n\n        try {\n            // Attempt to parse the JWT\n            $token = $this->jwtConfiguration->parser()->parse($jwt);\n        } catch (Exception $exception) {\n            throw OAuthServerException::accessDenied($exception->getMessage(), null, $exception);\n        }\n\n        try {\n            // Attempt to validate the JWT","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/thephpleague/oauth2-server/blob/9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c/src/AuthorizationValidators/BearerTokenValidator.php#L81-L117","documentation":"BearerTokenValidator::validateAuthorization() requires an HTTP Authorization header to authenticate the resource request. Without one it throws an access_denied error immediately, before any JWT parsing.","triggerScenarios":"Calling validateAuthorization() on a PSR-7 request that has no Authorization header (anonymous request, or middleware ordering removed it).","commonSituations":"Frontend didn't attach the token; CORS preflight sent to protected route; reverse proxy strips Authorization header; client sends 'authorization' via query param instead.","solutions":["Send 'Authorization: Bearer <access_token>' on the request.","Check proxies/CORS middleware aren't stripping the Authorization header.","Confirm the request is hitting validateAuthorization only after authentication on the client side."],"exampleFix":"// before\n$response = $client->get('https://api.example.com/me');\n// after\n$response = $client->get('https://api.example.com/me', ['headers' => ['Authorization' => 'Bearer ' . $accessToken]]);","handlingStrategy":"validation","validationCode":"if (!isset($_SERVER['HTTP_AUTHORIZATION']) && !isset(apache_request_headers()['Authorization'] ?? null)) {\n    throw new \\RuntimeException('Authorization header missing');\n}","typeGuard":null,"tryCatchPattern":"try { $request = $validator->validateAuthorization($request); } catch (OAuthServerException $e) { return $e->generateHttpResponse(new Response(), 401); }","preventionTips":["Attach the Bearer header in a single client-side API helper","Check .htaccess/nginx config passes Authorization through (e.g. SetEnvIf Authorization)"],"tags":["oauth","bearer-token","http-header"],"backgroundTag":"authentication-required","analyzedSha":"9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c","analyzedAt":"2026-09-15T22:33:30.452Z","contentChangedAt":"2026-09-15T22:33:30.452Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}