{"record":{"id":"af8e87b6d5be04f8","repo":"ruvnet/RuView","slug":"jwt-authentication-is-not-configured-configure-jw","errorCode":null,"errorMessage":"JWT authentication is not configured. Configure JWT_SECRET and JWT_ALGORITHM environment variables, or integrate an external identity provider. See docs/authentication.md for setup instructions.","messagePattern":"JWT authentication is not configured\\. Configure JWT_SECRET and JWT_ALGORITHM environment variables, or integrate an external identity provider\\. See docs/authentication\\.md for setup instructions\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"archive/v1/src/api/dependencies.py","lineNumber":101,"sourceCode":"    if settings.is_development:\n        logger.warning(\n            \"Authentication credentials provided in development mode but JWT \"\n            \"validation is not configured. Set up JWT authentication via \"\n            \"environment variables (JWT_SECRET, JWT_ALGORITHM) or disable \"\n            \"authentication. Rejecting request.\"\n        )\n        raise HTTPException(\n            status_code=status.HTTP_401_UNAUTHORIZED,\n            detail=(\n                \"JWT authentication is not configured. In development mode, either \"\n                \"disable authentication (enable_authentication=False) or configure \"\n                \"JWT validation. Returning mock users is not permitted in any environment.\"\n            ),\n            headers={\"WWW-Authenticate\": \"Bearer\"},\n        )\n\n    # In production, implement proper JWT validation\n    raise HTTPException(\n        status_code=status.HTTP_401_UNAUTHORIZED,\n        detail=(\n            \"JWT authentication is not configured. Configure JWT_SECRET and \"\n            \"JWT_ALGORITHM environment variables, or integrate an external \"\n            \"identity provider. See docs/authentication.md for setup instructions.\"\n        ),\n        headers={\"WWW-Authenticate\": \"Bearer\"},\n    )\n\n\nasync def get_current_active_user(\n    current_user: Optional[Dict[str, Any]] = Depends(get_current_user)\n) -> Dict[str, Any]:\n    \"\"\"Get current active user (required authentication).\"\"\"\n    if not current_user:\n        raise HTTPException(\n            status_code=status.HTTP_401_UNAUTHORIZED,\n            detail=\"Authentication required\",","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/ruvnet/RuView/blob/4685618388a5e49fad5b3005806f3bdd6a7c25c3/archive/v1/src/api/dependencies.py#L83-L119","documentation":"The production branch of get_current_user: outside development mode, if JWT validation is not configured (JWT_SECRET/JWT_ALGORITHM missing), every request presenting credentials gets 401 with instructions to configure JWT or integrate an external identity provider. This is a hard deployment configuration failure, not a per-token problem.","triggerScenarios":"Production/staging deployment where JWT_SECRET is missing from the process environment; container or pod started without the secret mounted; settings loaded from a .env file that was not copied into the image; any authenticated call at all once the config is missing.","commonSituations":"Secrets not wired into Docker/Kubernetes manifests; migrating to a new host without the env files; CI environment differing from prod; is_development accidentally true in dev masked the gap until deploy.","solutions":["Set JWT_SECRET (and JWT_ALGORITHM, e.g. HS256) in the server environment and restart the process","Add a startup assertion that fails fast when authentication is enabled but JWT is unconfigured, so misconfiguration surfaces at boot instead of per-request","If using an external identity provider, integrate its key material/JWKS as the validation source","Confirm every step in docs/authentication.md is complete for the deployment target"],"exampleFix":"# before\n# container started without secrets -> every authed request 401\n\n# after\ndocker run -e JWT_SECRET=$JWT_SECRET -e JWT_ALGORITHM=HS256 ... ruview-api","handlingStrategy":"validation","validationCode":"# Deployment preflight: never start prod without JWT config\nimport os\nmissing = [k for k in ('JWT_SECRET', 'JWT_ALGORITHM') if not os.environ.get(k)]\nif missing:\n    raise SystemExit(f'Refusing to start: missing {missing}. See docs/authentication.md')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount JWT secrets via the orchestrator's secret mechanism, not hand-copied files","Add a boot-time config validation step to the container entrypoint","Monitor for 401 spikes with this exact detail string — they indicate config loss, not attacks"],"tags":["authentication","jwt","fastapi","configuration","deployment"],"backgroundTag":null,"analyzedSha":"4685618388a5e49fad5b3005806f3bdd6a7c25c3","analyzedAt":"2026-08-16T06:09:40.886Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}