{"record":{"id":"914df3c3b6f08535","repo":"laravel/framework","slug":"unauthenticated","errorCode":null,"errorMessage":"Unauthenticated.","messagePattern":"Unauthenticated\\.","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"src/Illuminate/Auth/Middleware/Authenticate.php","lineNumber":101,"sourceCode":"                return $this->auth->shouldUse($guard);\n            }\n        }\n\n        $this->unauthenticated($request, $guards);\n    }\n\n    /**\n     * Handle an unauthenticated user.\n     *\n     * @param  \\Illuminate\\Http\\Request  $request\n     * @param  array  $guards\n     * @return never\n     *\n     * @throws \\Illuminate\\Auth\\AuthenticationException\n     */\n    protected function unauthenticated($request, array $guards)\n    {\n        throw new AuthenticationException(\n            'Unauthenticated.',\n            $guards,\n            $request->expectsJson() ? null : $this->redirectTo($request),\n        );\n    }\n\n    /**\n     * Get the path the user should be redirected to when they are not authenticated.\n     *\n     * @param  \\Illuminate\\Http\\Request  $request\n     * @return string|null\n     */\n    protected function redirectTo(Request $request)\n    {\n        if (static::$redirectToCallback) {\n            return call_user_func(static::$redirectToCallback, $request);\n        }\n    }","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/laravel/framework/blob/e0f6eb3518ac29fbbca8529e97d0df7fc9f24481/src/Illuminate/Auth/Middleware/Authenticate.php#L83-L119","documentation":"Thrown as AuthenticationException by the Authenticate middleware when none of the configured guards can authenticate the current request. It carries the list of guards checked and a redirect target (null for JSON requests). This is the standard '401-style' signal that an unauthenticated user reached a protected route.","triggerScenarios":"A request without a valid session/token hits a route protected by the 'auth' or 'auth:guard' middleware; token-based requests where the token is missing/invalid/expired; session guards where the session expired or was never established.","commonSituations":"Accessing a protected page after session timeout; calling an API route without the auth token header; misconfigured Sanctum/Passport stateful domains causing SPA auth to fail; route middleware ordering placing 'auth' before 'auth:api' on JSON endpoints.","solutions":["For web: ensure the user logs in (redirect to login is automatic via redirectTo()).","For API: send a valid token/credential (Bearer token, Sanctum SPA cookie, etc.) in the request.","Verify the correct guard is applied to the route and that the session/token is actually valid.","Check that session lifetime and Sanctum stateful domains are configured for your SPA.","Handle the exception globally to return a JSON 401 for API clients via Handler/ExceptionHandler."],"exampleFix":"// before — calling a protected API without a token\n// GET /api/me   ->  AuthenticationException('Unauthenticated.')\n\n// after — send a valid bearer token\n// headers: Authorization: Bearer <sanctum-token>\n$response = Http::withToken($token)->get('/api/me');\n\n// global handler for API responses\nprotected function unauthenticated($request, AuthenticationException $e)\n{\n    return $request->expectsJson()\n        ? response()->json(['message' => $e->getMessage()], 401)\n        : redirect()->guest(route('login'));\n}","handlingStrategy":"try-catch","validationCode":"// PHP — detect unauthenticated state before protected work\nif (! Auth::guard($guard)->check()) {\n    return $request->expectsJson()\n        ? response()->json(['message' => 'Unauthenticated.'], 401)\n        : redirect()->guest(route('login'));\n}\n// proceed with protected logic","typeGuard":"function isAuthenticated(string $guard = null): bool {\n    return Auth::guard($guard)->check();\n}","tryCatchPattern":"try {\n    // route runs the auth middleware\n} catch (\\Illuminate\\Auth\\AuthenticationException $e) {\n    return $request->expectsJson()\n        ? response()->json(['message' => $e->getMessage()], 401)\n        : redirect()->guest($e->redirectTo($request) ?? route('login'));\n}","preventionTips":["Send valid tokens/cookies on protected requests.","Ensure session lifetime matches app needs.","Register a global unauthenticated() handler that returns JSON for API clients."],"tags":["authentication","middleware","laravel","http"],"backgroundTag":null,"analyzedSha":"e0f6eb3518ac29fbbca8529e97d0df7fc9f24481","analyzedAt":"2026-08-11T20:52:37.562Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}