{"record":{"id":"ea8b3601593406ec","repo":"plandex-ai/plandex","slug":"invalid-auth-header","errorCode":null,"errorMessage":"invalid auth header","messagePattern":"invalid auth header","errorType":"validation","errorClass":null,"httpStatus":401,"severity":"error","filePath":"app/server/handlers/auth_helpers.go","lineNumber":56,"sourceCode":"\t\tcookie, err := r.Cookie(\"authToken\")\n\t\tif err != nil {\n\t\t\tif err == http.ErrNoCookie {\n\t\t\t\tlog.Println(\"no auth cookie\")\n\t\t\t\treturn nil, nil\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"error retrieving auth cookie: %v\", err)\n\t\t}\n\t\t// Use the token from the cookie as the fallback authorization header\n\t\tauthHeader = cookie.Value\n\t\tlog.Println(\"got auth header from cookie\")\n\t}\n\n\tif authHeader == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tif !strings.HasPrefix(authHeader, \"Bearer \") {\n\t\treturn nil, fmt.Errorf(\"invalid auth header\")\n\t}\n\n\t// strip off the \"Bearer \" prefix\n\tencoded := strings.TrimPrefix(authHeader, \"Bearer \")\n\n\t// decode the base64-encoded credentials\n\tbytes, err := base64.URLEncoding.DecodeString(encoded)\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error decoding auth token: %v\", err)\n\t}\n\n\t// parse the credentials\n\tvar parsed shared.AuthHeader\n\terr = json.Unmarshal(bytes, &parsed)\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error parsing auth token: %v\", err)","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/auth_helpers.go#L38-L74","documentation":"GetAuthHeader parses the Authorization header and requires the 'Bearer ' prefix. If the header is present but does not start with 'Bearer ', this error is thrown because the scheme is unsupported and the token cannot be extracted.","triggerScenarios":"A request includes an Authorization header that is non-empty but lacks the 'Bearer ' prefix — e.g. 'Basic dXNlcjpwYXNz', a bare token without scheme, or a misspelled scheme like 'bearer' in some clients is fine only if lowercase handled; here any non-'Bearer ' prefix fails. Called via SetAuthCookieIfBrowser and execAuthenticate.","commonSituations":"API clients using Basic auth or custom schemes against this server, curl commands pasted without the 'Bearer ' prefix, proxies stripping or rewriting the header, or older client versions sending a different scheme.","solutions":["Send the header as 'Authorization: Bearer <token>' from the client","Fix the client/curl invocation to include the Bearer scheme","Check middleware/proxies that may rewrite or truncate the Authorization header","Note: an empty Authorization header is tolerated (returns nil,nil); only a malformed non-empty header throws","Update outdated client SDK versions that used a legacy auth scheme"],"exampleFix":"// before\nreq.Header.Set(\"Authorization\", token)\n// after\nreq.Header.Set(\"Authorization\", \"Bearer \"+token)","handlingStrategy":"validation","validationCode":"// client side, before sending\nauth := token\nif !strings.HasPrefix(auth, \"Bearer \") { auth = \"Bearer \" + auth }\nreq.Header.Set(\"Authorization\", auth)","typeGuard":"func hasBearerScheme(h http.Header) bool {\n    return strings.HasPrefix(h.Get(\"Authorization\"), \"Bearer \")\n}","tryCatchPattern":"authHeader, err := GetAuthHeader(r)\nif err != nil {\n    if err.Error() == \"invalid auth header\" { http.Error(w, \"unsupported authorization scheme\", http.StatusBadRequest); return }\n    http.Error(w, err.Error(), http.StatusUnauthorized)\n}","preventionTips":["Always prefix tokens with 'Bearer ' exactly (capital B, single space)","Don't use Basic auth or other schemes against endpoints expecting Bearer","Check proxies/middleware don't rewrite the Authorization header","Handle the nil,nil (empty header) case distinctly from malformed headers"],"tags":["go","http","auth","bearer-token"],"backgroundTag":"invalid-authorization-header","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}