{"id":"dc6385ebb4e23fbc","repo":"tiangolo/fastapi","slug":"invalid-x-token-header-dc6385","errorCode":null,"errorMessage":"Invalid X-Token header","messagePattern":"Invalid X-Token header","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"docs_src/app_testing/app_b_py310/main.py","lineNumber":23,"sourceCode":"\nfake_db = {\n    \"foo\": {\"id\": \"foo\", \"title\": \"Foo\", \"description\": \"There goes my hero\"},\n    \"bar\": {\"id\": \"bar\", \"title\": \"Bar\", \"description\": \"The bartenders\"},\n}\n\napp = FastAPI()\n\n\nclass Item(BaseModel):\n    id: str\n    title: str\n    description: str | None = None\n\n\n@app.get(\"/items/{item_id}\", response_model=Item)\nasync def read_main(item_id: str, x_token: str = Header()):\n    if x_token != fake_secret_token:\n        raise HTTPException(status_code=400, detail=\"Invalid X-Token header\")\n    if item_id not in fake_db:\n        raise HTTPException(status_code=404, detail=\"Item not found\")\n    return fake_db[item_id]\n\n\n@app.post(\"/items/\")\nasync def create_item(item: Item, x_token: str = Header()) -> Item:\n    if x_token != fake_secret_token:\n        raise HTTPException(status_code=400, detail=\"Invalid X-Token header\")\n    if item.id in fake_db:\n        raise HTTPException(status_code=409, detail=\"Item already exists\")\n    fake_db[item.id] = item.model_dump()\n    return item\n","sourceCodeStart":5,"sourceCodeEnd":37,"githubUrl":"https://github.com/tiangolo/fastapi/blob/42a41db11f6882807ac3c057b942178d53b97438/docs_src/app_testing/app_b_py310/main.py#L5-L37","documentation":"Identical guard to error 0 but in the non-Annotated (default-value) variant of the app-testing example: GET /items/{item_id} raises HTTP 400 when the X-Token header != \"coneofsilence\". Only the parameter declaration style (x_token: str = Header() vs Annotated[str, Header()]) differs; behavior is identical.","triggerScenarios":"GET /items/{item_id} without a correct X-Token header against the app_b_py310 variant of the app.","commonSituations":"Same as error 0: missing/mismatched header in test clients or frontends.","solutions":["Send X-Token: coneofsilence on the GET request.","Prefer the Annotated style for new code; ensure the header value matches.","Centralize the token in config."],"exampleFix":"# before\nclient.get(\"/items/foo\")\n# after\nclient.get(\"/items/foo\", headers={\"X-Token\": \"coneofsilence\"})","handlingStrategy":"validation","validationCode":"EXPECTED_TOKEN = \"coneofsilence\"\nheaders = {\"X-Token\": EXPECTED_TOKEN}\nclient.get(\"/items/foo\", headers=headers)","typeGuard":"def has_valid_token(token: str | None) -> bool:\n    return token == \"coneofsilence\"","tryCatchPattern":null,"preventionTips":["Inject the token via a shared request helper.","Source the token from config, not inline literals.","Assert the header exists in tests."],"tags":["fastapi","authentication","http-headers","httpexception"],"analyzedSha":"42a41db11f6882807ac3c057b942178d53b97438","analyzedAt":"2026-08-04T19:23:32.007Z","schemaVersion":2}