yudai/gotty · error

Bad Request

Error message

Bad Request

What it means

Basic-auth middleware rejection (StatusUnauthorized/Bad Request class): the Authorization header is missing or not shaped as '<scheme> <token>' — the split produces fewer than 2 parts — so the request never reaches the wrapped handler. It guards credential checks, firing on malformed headers before credential comparison.

Source

Thrown at server/middleware.go:32

		log.Printf("%s %d %s %s", r.RemoteAddr, rw.status, r.Method, r.URL.Path)
	})
}

func (server *Server) wrapHeaders(handler http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// todo add version
		w.Header().Set("Server", "GoTTY")
		handler.ServeHTTP(w, r)
	})
}

func (server *Server) wrapBasicAuth(handler http.Handler, credential string) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		token := strings.SplitN(r.Header.Get("Authorization"), " ", 2)

		if len(token) != 2 || strings.ToLower(token[0]) != "basic" {
			w.Header().Set("WWW-Authenticate", `Basic realm="GoTTY"`)
			http.Error(w, "Bad Request", http.StatusUnauthorized)
			return
		}

		payload, err := base64.StdEncoding.DecodeString(token[1])
		if err != nil {
			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
			return
		}

		if credential != string(payload) {
			w.Header().Set("WWW-Authenticate", `Basic realm="GoTTY"`)
			http.Error(w, "authorization failed", http.StatusUnauthorized)
			return
		}

		log.Printf("Basic Authentication Succeeded: %s", r.RemoteAddr)
		handler.ServeHTTP(w, r)
	})

View on GitHub (pinned to a080c85cbc)

Solutions

1. Send 'Authorization: Basic <base64(user:pass)>' (or the expected scheme) on every request
2. Fix clients that send bare tokens without the scheme prefix
3. Return 401 with WWW-Authenticate so browsers prompt correctly

When it happens

Trigger: Thrown at server/middleware.go:32 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of yudai/gotty@a080c85cbc (2026-09-02). Data as JSON: /api/errors/89e69472228a29b5. Report an issue: GitHub.