Skip to content

REST API: Unhelpful response on unauthenticated requests #15076

Description

@daun

Bug description

When using auth tokens to authenticate the REST API, an unauthenticated request does not get a very helpful response. When the app is in production, it returns an empty message. When the app is in development/debug mode, a full stack trace of the abort function call is returned.

Expected result

A message saying "unauthenticated" and an http header with info on how to supply the token.

WWW-Authenticate: Bearer
{
    "message": "Unauthenticated."
}

Actual result

Production

{
    "message": ""
}

Development

{
    "message": "",
    "exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException",
    "file": "/Users/user/Sites/site/vendor/laravel/framework/src/Illuminate/Foundation/Application.php",
    "line": 1447,
    "trace": [
        {
            "file": "/Users/user/Sites/site/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php",
            "line": 67,
            "function": "abort",
            "class": "Illuminate\\Foundation\\Application",
            "type": "->"
        }
    ]
}

How to reproduce

Enable REST API, set an auth token, and request the API without an auth token.

STATAMIC_API_ENABLED=true
STATAMIC_API_AUTH_TOKEN=very-long-string

Logs

Environment

Environment
Laravel Version: 13.21.1
PHP Version: 8.4.20
Composer Version: 2.8.3
Environment: local
Debug Mode: ENABLED
Maintenance Mode: OFF
Timezone: Europe/Vienna
Locale: de

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: file
Database: sqlite
Logs: stack / daily
Mail: log
Queue: database
Session: file

Storage
public/storage: NOT LINKED

Statamic
Addons: 15
License Key: Not set
Sites: 2 (DE, EN)
Stache Watcher: Enabled
Static Caching: Disabled
Version: 6.26.0 PRO

Statamic Eloquent Driver
Addon Settings: eloquent
Asset Containers: file
Assets: eloquent
Blueprints: file
Collection Trees: eloquent
Collections: file
Entries: eloquent
Fieldsets: file
Form Submissions: eloquent
Forms: file
Global Sets: file
Global Variables: eloquent
Navigation Trees: eloquent
Navigations: file
Revisions: eloquent
Sites: file
Taxonomies: file
Terms: eloquent
Tokens: eloquent

Installation

Fresh statamic/statamic site via CLI

Additional details

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions