Dependency Graph

View IssueRelationship GraphVerticalShow Summary
Dependency Graph
related to related to child of child of duplicate of duplicate of

View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0037333mantisbtapi restpublic2026-07-30 03:272026-09-09 19:19
Reporterkhushal Assigned Todregad  
PrioritynormalSeverityminorReproducibilityhave not tried
Status resolvedResolutionfixed 
Product Version2.28.0 
Target Version2.29.0Fixed in Version2.29.0 
Summary0037333: Accept optional Bearer prefix on API token in Authorization header
Description

The REST API only accepts the API token bare (Authorization: <token>). It rejects Authorization: Bearer <token>, which is the RFC 6750 convention and the default for most HTTP clients, SDKs, API tools, and AI agents. Users routinely send the Bearer form and get an authentication failure with no indication of the cause.

Proposal: strip an optional, case-insensitive Bearer prefix before token lookup. The bare form remains fully supported, so the change is additive. Other schemes (e.g. Basic) are unaffected. Invalid tokens fail identically with or without the prefix, so no new failure path is introduced.

Additional Information

PR https://github.com/mantisbt/mantisbt/pull/2252

TagsNo tags attached.

Relationships

Relationship GraphDependency Graph
child of 0035286 resolveddregad REST API: follow Standards for Authorization header 

Activities

dregad

dregad

2026-08-30 13:40

developer   ~0071394

@khushal, I noticed today that your PR introduced 2 minor issues in the unit tests

  1. deprecation notices caused by missing static keyword for data provider methods
  2. testUnauthorizedResponseAdvertisesBearerScheme marked as skipped when anonymous login is enabled

I'll take care of fixing 1.

Regarding 2, while it's technically correct, I believe it would be preferable for the tests to cover both $g_allow_anonymous_login usage scenarios, i.e.

  • ON => No 401 response
  • OFF => 401 with WWW-Authenticate header

Could you please send a PR amending the tests as described above ?
khushal

khushal

2026-08-31 05:16

reporter   ~0071395

Last edited: 2026-08-31 05:17

@dregad Here is the PR: 2271 — the test no longer skips, it now asserts both cases:
anonymous login ON → no 401, OFF → 401 with WWW-Authenticate: Bearer.

Related Changesets

MantisBT: master cf9fe3bf

2026-07-30 03:29

khushal

Committer: vboctor


Details Diff		 Accept optional Bearer prefix on API token

The REST API only accepted the API token bare
('Authorization: <token>') and rejected the RFC 6750 bearer form
('Authorization: Bearer <token>'). Bearer is what most HTTP clients,
SDKs, API tools, and AI agents send by default, so users routinely got
an authentication failure with no indication of the cause.

api_token_parse_credentials() strips an optional 'Bearer ' prefix
before the token lookup. The scheme name is matched case-insensitively,
and SP or HTAB between the scheme and the token is tolerated per
RFC 7230. Credentials using any other scheme (e.g. 'Basic ...') are
returned unchanged and continue to fail token validation as before.

The bare form remains fully supported, so the change is additive. An
invalid token is handled identically with or without the prefix, so no
separate code path or failure mode is introduced.

Also documents both accepted forms in the OpenAPI and Swagger
definitions.

Fixes 0037333		 Affected Issues
0037333
mod - api/rest/mantisbt_openapi.yaml Diff File
mod - api/rest/restcore/AuthMiddleware.php Diff File
mod - api/rest/swagger.json Diff File
mod - core/api_token_api.php Diff File
add - tests/Mantis/ApiTokenApiTest.php Diff File
add - tests/rest/RestAuthHeaderTest.php Diff File

MantisBT: master 085645cb

2026-08-03 07:25

khushal

Committer: vboctor


Details Diff		 Return WWW-Authenticate header on 401 and finish bearer support Affected Issues
0037333
mod - api/rest/api.postman_collection.json Diff File
mod - api/rest/mantisbt_openapi.yaml Diff File
mod - api/rest/restcore/AuthMiddleware.php Diff File
mod - core/api_token_api.php Diff File
mod - core/constant_inc.php Diff File
mod - docbook/Developers_Guide/en-US/Api_Rest.xml Diff File
mod - tests/Mantis/ApiTokenApiTest.php Diff File
mod - tests/rest/RestAuthHeaderTest.php Diff File

MantisBT: master 11b27326

2026-08-30 05:21

dregad


Details Diff		 PHPUnit: data providers should be static

Deprecation warning introduced by Issue 0037333.		 Affected Issues
0037333
mod - tests/Mantis/ApiTokenApiTest.php Diff File
mod - tests/rest/RestAuthHeaderTest.php Diff File

MantisBT: master 6a8b3192

2026-08-30 13:31

dregad


Details Diff		 PHPUnit: fail on all issues

The CI builds are not marked as failed when those "secondary" issues
occurs. It would be preferable if they did, so that problems are
detected early, and fixed as part of the PR process.

Recent examples:
- Deprecated warnings introduced by Issue 0037333
- Skipped tests introduced by Issues 0032470, 0037333		 Affected Issues
0032470, 0037333
mod - phpunit.xml Diff File

MantisBT: master 8803f5d5

2026-09-03 18:41

khushal

Committer: community


Details Diff		 Assert both anonymous login modes in REST auth header test

Replaces the skip with assertions for both configurations:
- no 401 when anonymous login is ON,
- 401 with WWW-Authenticate when OFF.

Fixes 0037333, PR https://github.com/mantisbt/mantisbt/pull/2271		 Affected Issues
0037333
mod - tests/rest/RestAuthHeaderTest.php Diff File

MantisBT: master 9ece70d4

2026-09-03 19:11

dregad


Details Diff		 REST API auth without Bearer scheme is deprecated

Update documentation to reflect that.

Fixes 0035286, 0037333		 Affected Issues
0035286, 0037333
mod - api/rest/mantisbt_openapi.yaml Diff File
mod - docbook/Developers_Guide/en-US/Api_Rest.xml Diff File