theonedev/onedev · error · UnauthenticatedException

Not authenticated

Error message

Not authenticated

What it means

AnonymousCheckFilter is a JAX-RS container request filter guarding REST resources. If the resource class lacks @Api(internal=true), the requester is anonymous, and the resource is not TriggerJobResource, it rejects state-changing methods (POST/DELETE/PUT) and also GET etc. when anonymous access is disabled in security settings, by throwing UnauthenticatedException 'Not authenticated'.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/AnonymousCheckFilter.java:44

	private ResourceInfo resourceInfo;
	
	@Context
	private HttpServletRequest request;
	
	@Inject
	public AnonymousCheckFilter(SettingService settingService) {
		this.settingService = settingService;
	}
	
	@Override
	public void filter(ContainerRequestContext requestContext) throws IOException {
		Api api = resourceInfo.getResourceClass().getAnnotation(Api.class);
		if ((api == null || !api.internal()) && SecurityUtils.isAnonymous() 
				&& resourceInfo.getResourceClass() != TriggerJobResource.class) { 
			String method = request.getMethod();
			if (method.equals("POST") || method.equals("DELETE") || method.equals("PUT") 
					|| !settingService.getSecuritySetting().isEnableAnonymousAccess()) {
				throw new UnauthenticatedException();
			}
		}
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Add an Authorization header with a valid OneDev access token (login/password or access token) to the request
2. Enable anonymous access in security settings only if the resource is intentionally public (not recommended for writes)
3. Use GET instead of POST/DELETE/PUT for anonymous read-only endpoints when anonymous access is enabled
4. Verify the resource is meant to be internal-only; if calling an internal @Api(internal=true) resource is intended, that path is exempt

Example fix

// before
curl -X POST http://onedev/api/projects
// after
curl -X POST -H "Authorization: Bearer <access-token>" http://onedev/api/projects

// before calling the API, ensure credentials are configured
if (accessToken == null) {
    throw new IllegalStateException("OneDev access token required for this endpoint");
}

try {
    Response resp = client.target(url).request()
        .header("Authorization", "Bearer " + token)
        .post(entity);
} catch (NotAuthorizedException e) {
    // refresh/obtain access token and retry once
}

When it happens

Trigger: Anonymous HTTP calls to REST resources that are POST/DELETE/PUT, or any method when anonymous access is disabled, on non-internal resource classes (everything except @Api(internal=true) and TriggerJobResource).

Common situations: CI scripts or webhooks calling the API without an access token; users who disabled anonymous access in security settings but still use unauthenticated GETs; missing Authorization header / expired access token; reverse proxy stripping auth headers.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication required
• Unauthenticated
• This api can only be accessed via cluster credential
• Not authenticated
• "Please login to perform this query"

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/083a9d2803a75900. Report an issue: GitHub.