Skip to content

No token has incorrect status code #56

@prowley

Description

@prowley

Checklist

  • I have looked into the Readme and Examples, and have not found a suitable solution or answer.
  • I have looked into the API documentation and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.

Description

When there is no bearer token require_auth incorrectly throws 400 status code with error code invalid_request. RFC 6750 section 3.1 explicitly states (after discussion of which error code to use when and what status code should be used):

If the request lacks any authentication information (e.g., the client
was unaware that authentication is necessary or attempted using an
unsupported authentication method), the resource server SHOULD NOT
include an error code or other error information.

For example:

 HTTP/1.1 401 Unauthorized
 WWW-Authenticate: Bearer realm="example"

Reproduction

  1. access api with no token
  2. receive status 400 with invalid_request error code

Additional context

No response

auth0-fastapi-api version

1.0.0b3

Python version

3.12.9

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions