{"record":{"id":"ccb428b4e5694c49","repo":"theonedev/onedev","slug":"not-authorized-ccb428","errorCode":null,"errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/SshKeyResource.java","lineNumber":77,"sourceCode":"\t\t\n\t\tsshKey.setCreatedAt(new Date());\n    \tsshKey.generateFingerprint();\n    \t\n    \tsshKeyService.create(sshKey);\n\t\tif (!getAuthUser().equals(sshKey.getOwner())) {\n\t\t\tvar newAuditContent = VersionedXmlDoc.fromBean(sshKey).toXML();\n\t\t\tauditService.audit(null, \"created ssh key in account \\\"\" + sshKey.getOwner().getName() + \"\\\" via RESTful API\", null, newAuditContent);\n\t\t}\n    \treturn sshKey.getId();\n\t}\n\t\n\t@Api(order=200)\n\t@Path(\"/{sshKeyId}\")\n\t@DELETE\n\tpublic Response deleteKey(@PathParam(\"sshKeyId\") Long sshKeyId) {\n\t\tSshKey sshKey = sshKeyService.load(sshKeyId);\n    \tif (!SecurityUtils.isAdministrator() && !sshKey.getOwner().equals(getAuthUser())) \n\t\t\tthrow new UnauthorizedException();\n\t\tsshKeyService.delete(sshKey);\n\t\tif (!getAuthUser().equals(sshKey.getOwner())) {\n\t\t\tvar oldAuditContent = VersionedXmlDoc.fromBean(sshKey).toXML();\n\t\t\tauditService.audit(null, \"deleted ssh key from account \\\"\" + sshKey.getOwner().getName() + \"\\\" via RESTful API\", oldAuditContent, null);\n\t\t}\n\t\treturn Response.ok().build();\n\t}\n\t\n}\n","sourceCodeStart":59,"sourceCodeEnd":87,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/SshKeyResource.java#L59-L87","documentation":"Authorization guard in SshKeyResource.deleteKey: the authenticated user is not an administrator and does not own the target SSH key, so deleting another account's key is forbidden; UnauthorizedException is thrown. Fix: delete only keys owned by the authenticated user, or use an administrator account.","triggerScenarios":"Deleting another user's SSH key without administrator rights; key id refers to a key owned by a different account than the authenticated user.","commonSituations":"Scripts iterating all SSH keys and deleting them with a regular user token; id mismatch after key recreation.","solutions":["Authenticate as the key's owner","Use an administrator account to delete other users' keys","Verify the sshKeyId belongs to the authenticated user before deleting"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// ensure authenticated user is key owner or admin before DELETE","typeGuard":null,"tryCatchPattern":"try { await api.deleteSshKey(id); } catch (e) { if (e.status === 401) throw new Error('Only key owner or admin can delete'); }","preventionTips":["Look up the key's owner before deleting","Use admin credentials for cross-account key management"],"tags":["rest-api","ssh-keys","permissions"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}