{"record":{"id":"af9d8fd77bf0946d","repo":"pinpoint-apm/pinpoint","slug":"authorization-error","errorCode":null,"errorMessage":"Authorization Error: {}","messagePattern":"Authorization Error: (.+?)","errorType":"http","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"collector/src/main/java/com/navercorp/pinpoint/collector/manage/controller/AuthInterceptor.java","lineNumber":89,"sourceCode":"        }\n\n        String password = request.getParameter(\"password\");\n        if (!this.password.equals(password)) {\n            String jsonError = jsonError(\"not matched admin password\");\n            writeJsonError(response, HttpStatus.FORBIDDEN, jsonError);\n            return false;\n        }\n\n        return true;\n    }\n\n    private String jsonError(String errorMessage) throws JsonProcessingException {\n        MapResponse response = new MapResponse(Result.FAIL, errorMessage);\n        return mapper.writeValueAsString(response);\n    }\n\n    private void writeJsonError(HttpServletResponse response, HttpStatus unauthorized, String jsonError) throws IOException {\n        logger.warn(\"Authorization Error: {}\", jsonError);\n\n        response.setContentType(MediaType.APPLICATION_JSON_VALUE);\n        response.setStatus(unauthorized.value());\n        response.getWriter().write(jsonError);\n    }\n\n\n    @Override\n    public String toString() {\n        return \"AuthInterceptor{\" +\n                \"password='\" + password + '\\'' +\n                \", isActive=\" + isActive +\n                '}';\n    }\n}\n","sourceCodeStart":71,"sourceCodeEnd":105,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/collector/src/main/java/com/navercorp/pinpoint/collector/manage/controller/AuthInterceptor.java#L71-L105","documentation":"AuthInterceptor.preHandle fails authorization and calls writeJsonError, which logs \"Authorization Error: {}\" with the serialized JSON error and writes a JSON failure body (MapResponse with Result.FAIL) to the HttpServletResponse with the given unauthorized HTTP status. The message is the log line accompanying an HTTP 401-style rejection of an unauthenticated collector management/API request.","triggerScenarios":"A client request to a collector management endpoint fails preHandle authentication (missing/invalid API key or credentials); the interceptor then serializes a JSON error and returns it with the unauthorized status while logging this warning.","commonSituations":"Collector REST API called without an Authorization header; wrong or expired API key in client config; a proxy stripping auth headers; internal service hitting an auth-enabled collector unexpectedly.","solutions":["Inspect the logged jsonError body to see the specific failure reason returned to the client","Supply valid credentials/API key in the request (Authorization header) as configured on the collector","Verify the collector's auth configuration (enabled flag, expected key) matches what the client sends","Check for reverse proxies or gateways stripping or mangling the Authorization header"],"exampleFix":"// before\ncurl http://collector:8080/manage/agentInfo\n// after\ncurl -H \"Authorization: Bearer <valid-api-key>\" http://collector:8080/manage/agentInfo","handlingStrategy":"try-catch","validationCode":"if (authHeader == null || !authHeader.startsWith(\"Bearer \")) {\n    // fail fast client-side before calling the collector API\n    throw new IllegalArgumentException(\"Authorization header with a valid API key is required\");\n}","typeGuard":"boolean isAuthorized(String authHeader) {\n    return authHeader != null && !authHeader.isBlank() && authHeader.startsWith(\"Bearer \");\n}","tryCatchPattern":"Response resp = client.newCall(request).execute();\nif (resp.code() == 401) {\n    String body = resp.body().string(); // JSON MapResponse with failure reason\n    throw new AuthenticationException(\"Collector rejected credentials: \" + body);\n}","preventionTips":["Configure and rotate the collector API key consistently on client and server","Verify auth headers survive proxies/gateways in front of the collector","Monitor 401 responses from collector management endpoints","Match the collector's auth-enabled setting between environments"],"tags":["http","authentication","collector","rest-api"],"backgroundTag":"authentication-required","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}