{"record":{"id":"dd5c0ebc9162c85b","repo":"plandex-ai/plandex","slug":"no-auth-header","errorCode":null,"errorMessage":"no auth header","messagePattern":"no auth header","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"app/server/handlers/auth_helpers.go","lineNumber":479,"sourceCode":"}\n\nfunc execAuthenticate(w http.ResponseWriter, r *http.Request, requireOrg bool, raiseErr bool) *types.ServerAuth {\n\tlog.Println(\"authenticating request\")\n\n\tparsed, err := GetAuthHeader(r)\n\n\tif err != nil {\n\t\tlog.Printf(\"error getting auth header: %v\\n\", err)\n\t\tif raiseErr {\n\t\t\thttp.Error(w, \"error getting auth header\", http.StatusInternalServerError)\n\t\t}\n\t\treturn nil\n\t}\n\n\tif parsed == nil {\n\t\tlog.Println(\"no auth header\")\n\t\tif raiseErr {\n\t\t\thttp.Error(w, \"no auth header\", http.StatusUnauthorized)\n\t\t}\n\t\treturn nil\n\t}\n\n\t// validate the token\n\tauthToken, err := db.ValidateAuthToken(parsed.Token)\n\n\tif err != nil {\n\t\tlog.Printf(\"error validating auth token: %v\\n\", err)\n\n\t\twriteApiError(w, shared.ApiError{\n\t\t\tType:   shared.ApiErrorTypeInvalidToken,\n\t\t\tStatus: http.StatusUnauthorized,\n\t\t\tMsg:    \"Invalid auth token\",\n\t\t})\n\t\treturn nil\n\t}\n","sourceCodeStart":461,"sourceCodeEnd":497,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/auth_helpers.go#L461-L497","documentation":"GetAuthHeader succeeded but returned nil (no auth header present), so execAuthenticate logs 'no auth header' and, when raiseErr is true, returns HTTP 401. Distinguished from 801: the header was absent rather than malformed/unreadable.","triggerScenarios":"Any request to an Authenticate-wrapped endpoint with no Authorization header at all.","commonSituations":"Logged-out users hitting protected endpoints, browser fetch calls without credentials, health checks or scrapers hitting authenticated routes.","solutions":["Log in / obtain an auth token and send it in the Authorization header","Check the client's auth interceptor is attached to the request","Route unauthenticated traffic to endpoints that use AuthenticateOptional","Return 401 to the user so the client can redirect to login"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if req.Header.Get(\"Authorization\") == \"\" {\n\t// redirect to login / attach token before calling\n\treturn ErrNotAuthenticated\n}","typeGuard":null,"tryCatchPattern":"if err := doCall(ctx); err != nil {\n\tvar apiErr *APIError\n\tif errors.As(err, &apiErr) && apiErr.StatusCode == 401 && strings.Contains(apiErr.Message, \"no auth header\") {\n\t\treturn redirectToLogin()\n\t}\n\treturn err\n}","preventionTips":["Attach the token in a central HTTP client wrapper for all requests","Handle 401 globally by redirecting to login/token refresh","Don't call authenticated endpoints for anonymous flows","Add a pre-flight assertion that credentials are present before requests"],"tags":["http","auth","unauthorized"],"backgroundTag":"missing-authorization-header","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}