caddyserver/caddy · error

not authenticated

Error message

not authenticated

What it means

Error "not authenticated" thrown in caddyserver/caddy.

Source

Thrown at modules/caddyhttp/caddyauth/caddyauth.go:158

		}
		// When isolating, no failed provider's response reached the real
		// writer, so apply one provider's challenge headers (e.g. a
		// WWW-Authenticate, or a Location); a redirecting provider takes
		// precedence and is sent as a full response. A single provider already
		// wrote its challenge directly to the real writer. Either way, fall
		// through to the auth error so handle_errors runs and a challenge that
		// set only headers (like basic auth) still returns 401, not 200.
		if isolate {
			if replay := pickReplay(failed); replay != nil {
				maps.Copy(w.Header(), replay.header)
				if replay.statusCode >= 300 && replay.statusCode < 400 {
					w.WriteHeader(replay.statusCode)
					_, _ = w.Write(replay.buf.Bytes())
					return nil
				}
			}
		}
		return caddyhttp.Error(http.StatusUnauthorized, fmt.Errorf("not authenticated"))
	}

	// When isolating, the winning provider wrote to its buffer; copy the
	// headers it set (e.g. a Set-Cookie establishing a new session) onto the
	// real writer. Its status/body are NOT replayed: the request is
	// authenticated and continues down the handler chain, which produces the
	// actual response. (A single provider already wrote its headers directly.)
	if winner != nil {
		maps.Copy(w.Header(), winner.header)
	}

	setAuthUserPlaceholders(repl, "http.auth.user", user)

	return next.ServeHTTP(w, r)
}

// pickReplay chooses which failed provider's buffered response to send when
// no provider authenticated: a redirect (3xx) wins, otherwise the first

View on GitHub (pinned to 50e54ee279)

Solutions

1. Send valid credentials with the request (e.g. correct Authorization header for basic auth).
2. Verify the username and password match a configured account.

When it happens

Trigger: Thrown at modules/caddyhttp/caddyauth/caddyauth.go:158 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/36a2f68a7397627a. Report an issue: GitHub.