plandex-ai/plandex · error

error getting auth header

Error message

error getting auth header

What it means

execAuthenticate failed to read or parse the Authorization header via GetAuthHeader and logs 'error getting auth header'. When raiseErr is true (Authenticate, not AuthenticateOptional) it responds with HTTP 500. It indicates a malformed or unreadable auth header, not necessarily a missing one.

Source

Thrown at app/server/handlers/auth_helpers.go:471

	}

	if semver.Compare(version, minVersion) < 0 {
		http.Error(w, msg, http.StatusBadRequest)
		return false
	}

	return true
}

func execAuthenticate(w http.ResponseWriter, r *http.Request, requireOrg bool, raiseErr bool) *types.ServerAuth {
	log.Println("authenticating request")

	parsed, err := GetAuthHeader(r)

	if err != nil {
		log.Printf("error getting auth header: %v\n", err)
		if raiseErr {
			http.Error(w, "error getting auth header", http.StatusInternalServerError)
		}
		return nil
	}

	if parsed == nil {
		log.Println("no auth header")
		if raiseErr {
			http.Error(w, "no auth header", http.StatusUnauthorized)
		}
		return nil
	}

	// validate the token
	authToken, err := db.ValidateAuthToken(parsed.Token)

	if err != nil {
		log.Printf("error validating auth token: %v\n", err)

View on GitHub (pinned to e2d772072e)

Solutions

1. Ensure the client sends 'Authorization: Bearer <token>' on every authenticated request
2. Verify no reverse proxy or middleware strips or rewrites the Authorization header
3. Check GetAuthHeader's parsing logic matches the header format your client sends
4. If the request is meant to be anonymous, use AuthenticateOptional instead of Authenticate

Example fix

// before
req.Header.Set("Token", token) // wrong header
// after
req.Header.Set("Authorization", "Bearer "+token)

if req.Header.Get("Authorization") == "" {
	return fmt.Errorf("request missing Authorization header")
}

user, err := client.AuthenticatedUser(req)
if err != nil {
	var apiErr *APIError
	if errors.As(err, &apiErr) && apiErr.StatusCode == 500 && strings.Contains(apiErr.Message, "auth header") {
		log.Println("malformed auth header; fix header format")
		return nil
	}
	return err
}

When it happens

Trigger: Requests with a missing or malformed Authorization header (wrong scheme, non-Bearer format) hitting endpoints wrapped by Authenticate. AuthenticateOptional also calls this path but suppresses the HTTP error.

Common situations: Clients forgetting to attach the token, proxies/gateways stripping the Authorization header, hand-rolled headers not matching Bearer format expected by GetAuthHeader.

Related errors

• error setting auth header: auth not loaded
• invalid auth header
• no auth header
• User does not have permission to invite user with role:
• error loading accounts: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/356e1d8cb7b6b325. Report an issue: GitHub.