{"record":{"id":"fd8fcaadbde1aaf2","repo":"Mintplex-Labs/anything-llm","slug":"no-auth-token-found","errorCode":null,"errorMessage":"No auth token found.","messagePattern":"No auth token found\\.","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"server/utils/middleware/validatedRequest.js","lineNumber":37,"sourceCode":"    !process.env.JWT_SECRET\n  ) {\n    UserMetaCache.setFromRequest(request);\n    next();\n    return;\n  }\n\n  if (!process.env.AUTH_TOKEN) {\n    response.status(401).json({\n      error: \"You need to set an AUTH_TOKEN environment variable.\",\n    });\n    return;\n  }\n\n  const auth = request.header(\"Authorization\");\n  const token = auth ? auth.split(\" \")[1] : null;\n\n  if (!token) {\n    response.status(401).json({\n      error: \"No auth token found.\",\n    });\n    return;\n  }\n\n  const bcrypt = require(\"bcryptjs\");\n  const { p } = decodeJWT(token);\n\n  if (p === null || !/\\w{32}:\\w{32}/.test(p)) {\n    response.status(401).json({\n      error: \"Token expired or failed validation.\",\n    });\n    return;\n  }\n\n  // Since the blame of this comment we have been encrypting the `p` property of JWTs with the persistent\n  // encryptionManager PEM's. This prevents us from storing the `p` unencrypted in the JWT itself, which could\n  // be unsafe. As a consequence, existing JWTs with invalid `p` values that do not match the regex","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/utils/middleware/validatedRequest.js#L19-L55","documentation":"Auth guard in the validatedRequest middleware (single-user token path): AUTH_TOKEN is set but the Authorization header carries no token, so there is nothing to compare against the configured token and the request is refused with 401.","triggerScenarios":"Request to a protected route carried no auth token. Triggered when the Authorization header is missing (validatedRequest.js:37).","commonSituations":"See trigger scenarios.","solutions":["Include the Authorization header with a Bearer token on the request.","Log in first to obtain a token, then retry the request with it."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}