The current error handling in authentication is not optimal, as it always returns HTTP status code 500, regardless of whether no credentials were found in the header, the credentials are incorrect, or the user exists but is disabled. This prevents the client from distinguishing why authentication failed.
I noticed this problem in the browser console when navigating to the login page. Resources are being queried in the background even though we are not logged in. This would certainly be worth its own issue, but I will fix the problem piece by piece in smaller PRs.
Solution:
Similar to PR #819, I have adjusted the error handling to use different HTTP status codes and provide clearer information to the user about why authentication failed.
401 UNAUTHORIZED
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/moghtech/komodo/pull/841
**Author:** [@MP-Tool](https://github.com/MP-Tool)
**Created:** 9/11/2025
**Status:** ✅ Merged
**Merged:** 9/14/2025
**Merged by:** [@mbecker20](https://github.com/mbecker20)
**Base:** `1.19.4` ← **Head:** `fix/auth-get-user-error-handling`
---
### 📝 Commits (6)
- [`dfbf006`](https://github.com/moghtech/komodo/commit/dfbf00679ab3528a6afb917d5bfd178e7048d907) Refactor authentication error handling to use serror::Result and status codes
- [`b7b9580`](https://github.com/moghtech/komodo/commit/b7b9580fc998783dd212106459b24844d9b9c21f) Refactor error messages
- [`6dd9048`](https://github.com/moghtech/komodo/commit/6dd9048d663c66a0b670e5ad146d8d3c7c043c7d) Refactor authentication error handling to include status codes and improve error messages
- [`81ca3ee`](https://github.com/moghtech/komodo/commit/81ca3eeba969deb9992cc6bdcdc9423a99a74c32) clean up
- [`100acb8`](https://github.com/moghtech/komodo/commit/100acb8a24f089fa2006e04e7831c8128454e923) clean
- [`2295660`](https://github.com/moghtech/komodo/commit/2295660e437d7199092c7d01f5c03a8e42ed0fd0) fmt
### 📊 Changes
**1 file changed** (+3 additions, -2 deletions)
<details>
<summary>View changed files</summary>
📝 `bin/core/src/api/auth.rs` (+3 -2)
</details>
### 📄 Description
## Problem:
The current error handling in authentication is not optimal, as it always returns HTTP status code 500, regardless of whether no credentials were found in the header, the credentials are incorrect, or the user exists but is disabled. This prevents the client from distinguishing why authentication failed.
I noticed this problem in the browser console when navigating to the login page. Resources are being queried in the background even though we are not logged in. This would certainly be worth its own issue, but I will fix the problem piece by piece in smaller PRs.
## Solution:
Similar to PR #819, I have adjusted the error handling to use different HTTP status codes and provide clearer information to the user about why authentication failed.
401 UNAUTHORIZED
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/moghtech/komodo/pull/841
Author: @MP-Tool
Created: 9/11/2025
Status: ✅ Merged
Merged: 9/14/2025
Merged by: @mbecker20
Base:
1.19.4← Head:fix/auth-get-user-error-handling📝 Commits (6)
dfbf006Refactor authentication error handling to use serror::Result and status codesb7b9580Refactor error messages6dd9048Refactor authentication error handling to include status codes and improve error messages81ca3eeclean up100acb8clean2295660fmt📊 Changes
1 file changed (+3 additions, -2 deletions)
View changed files
📝
bin/core/src/api/auth.rs(+3 -2)📄 Description
Problem:
The current error handling in authentication is not optimal, as it always returns HTTP status code 500, regardless of whether no credentials were found in the header, the credentials are incorrect, or the user exists but is disabled. This prevents the client from distinguishing why authentication failed.
I noticed this problem in the browser console when navigating to the login page. Resources are being queried in the background even though we are not logged in. This would certainly be worth its own issue, but I will fix the problem piece by piece in smaller PRs.
Solution:
Similar to PR #819, I have adjusted the error handling to use different HTTP status codes and provide clearer information to the user about why authentication failed.
401 UNAUTHORIZED
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.