') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); REST API: Unhelpful response on unauthenticated requests · Issue #15076 · statamic/cms · GitHub
Skip to content

REST API: Unhelpful response on unauthenticated requests #15076

Closed
#15077
Closed
REST API: Unhelpful response on unauthenticated requests#15076
#15077
Labels
api

Description

@daun
daun
opened on Jul 24, 2026

Bug description

When using auth tokens to authenticate the REST API, an unauthenticated request does not get a very helpful response. When the app is in production, it returns an empty message. When the app is in development/debug mode, a full stack trace of the abort function call is returned.

Expected result

A message saying "unauthenticated" and an http header with info on how to supply the token.

WWW-Authenticate: Bearer

{
"message": "Unauthenticated."
}

Actual result

Production

{
"message": ""
}

Development

{
"message": "",
"exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException",
"file": "/Users/user/Sites/site/vendor/laravel/framework/src/Illuminate/Foundation/Application.php",
"line": 1447,
"trace": [
{
"file": "/Users/user/Sites/site/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php",
"line": 67,
"function": "abort",
"class": "Illuminate\\Foundation\\Application",
"type": "->"
}
]
}

How to reproduce

Enable REST API, set an auth token, and request the API without an auth token.

STATAMIC_API_ENABLED=true
STATAMIC_API_AUTH_TOKEN=very-long-string

Logs

Environment
EnvironmentLaravel Version: 13.21.1PHP Version: 8.4.20Composer Version: 2.8.3Environment: localDebug Mode: ENABLEDMaintenance Mode: OFFTimezone: Europe/ViennaLocale: deCacheConfig: NOT CACHEDEvents: NOT CACHEDRoutes: NOT CACHEDViews: CACHEDDriversBroadcasting: logCache: fileDatabase: sqliteLogs: stack / dailyMail: logQueue: databaseSession: fileStoragepublic/storage: NOT LINKEDStatamicAddons: 15License Key: Not setSites: 2 (DE, EN)Stache Watcher: EnabledStatic Caching: DisabledVersion: 6.26.0 PROStatamic Eloquent DriverAddon Settings: eloquentAsset Containers: fileAssets: eloquentBlueprints: fileCollection Trees: eloquentCollections: fileEntries: eloquentFieldsets: fileForm Submissions: eloquentForms: fileGlobal Sets: fileGlobal Variables: eloquentNavigation Trees: eloquentNavigations: fileRevisions: eloquentSites: fileTaxonomies: fileTerms: eloquentTokens: eloquent
Installation
Fresh statamic/statamic site via CLI
Additional details
No response
Metadata
Metadata
Assignees
No one assigned
    Labels
    api
    Type
    No type
    Projects
    No projects
    Milestone
    No milestone
    Relationships
    None yet
    Development
    No branches or pull requests
    Issue actions