View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0035286mantisbtapi restpublic2025-02-01 04:532026-09-09 19:19
Reporterdregad Assigned Todregad  
PrioritynormalSeverityfeatureReproducibilityhave not tried
Status resolvedResolutionfixed 
Target Version2.29.0Fixed in Version2.29.0 
Summary0035286: REST API: follow Standards for Authorization header
Description

Our implementation of API tokens in Authorization header is not compliant with the standard defined by RFC-9110, which requires that an authentication scheme is specified before the actual credentials, while we expect just Authorization: {{token}}.

We need to

  1. support Authorization: bearer {{token}} as a valid authorization mechanism and make it the default and suggested format
  2. deprecate usage of Authorization: {{token}}

See MDN reference on Authorization header and Authentication schemes for more practical information on the standard.

Additional Information

Follows discussion in PR https://github.com/mantisbt/mantisbt/pull/2071

@vboctor

I suggest the inspecting authorization header types - e.g. bearer, basic, NTLM, etc. As part of that we should support bearer in front of API tokens as the suggested format, while still support the case when bearer is not provided (treat it as default).

@dregad

I would even go one step further: deprecate use of Authorization header without bearer and remove it in the future, as it's not compliant with the standard.

@vboctor

I agree that we should deprecate the calls without the bearer prefix, but other than documenting this, I'm not sure how we want to surface such deprecation. We can log it, but that penalizes the server (by spamming the logs) for clients using deprecated behavior, etc. Blocking it just seems to harsh and will break the ecosystem a bit, for low value. Adding a deprecation response header is an option as well.

TagsNo tags attached.

Relationships

Relationship GraphDependency Graph
related to 0037367 confirmed REST API: remove token authentication without bearer scheme 
parent of 0037333 resolveddregad Accept optional Bearer prefix on API token in Authorization header 

Activities

raspopov

raspopov

2025-02-02 09:18

reporter   ~0069812

And need to remember to follow the recommendations from RFC 6750.
barts2108

barts2108

2026-01-15 09:13

reporter   ~0070714

Using office scripting fetch() (to make REST API calls) is doing a CORS (cross origin resource share) preflight OPTIONS request. That request does not contain the Authorization header, as the server should respond what kind of authorization is allowed. Upon such preflight OPTIONS request, Mantis API will respond with a 401 Api token required. Due to the 401 response, the fetch() call will not continue to make the GET request.

When the Authorization is changed to match the standard, IMHO the OPTIONS request should be changed to allow the OPTIONS request without api token.
vboctor

vboctor

2026-08-22 04:17

manager   ~0071361

This issue is partially covered by the PR below
PR: https://github.com/mantisbt/mantisbt/pull/2252

Documentation in the following PR:
PR: https://github.com/mantisbt/mantisbt/pull/2253

I haven't looked at the CORS issue.
dregad

dregad

2026-09-04 02:50

developer   ~0071407

Last edited: 2026-09-04 04:01

Following merge of the 2 PRs mentioned in 0035286:0071361 and resolution of 0037333, I believe this Issue should be considered as fixed.

I have submitted follow-up PR 2276 for the deprecation of the legacy usage of an Authentication header without bearer scheme:

  • documentation update (OpenAPI + Developers' Guide)
  • Issue an RFC 9745 Deprecation header to warn users that they should update their clients

Legacy auth without bearer scheme will be removed in a future release (see 0037367).

Related Changesets

MantisBT: master 9ece70d4

2026-09-03 19:11

dregad


Details Diff		 REST API auth without Bearer scheme is deprecated

Update documentation to reflect that.

Fixes 0035286, 0037333		 Affected Issues
0035286, 0037333
mod - api/rest/mantisbt_openapi.yaml Diff File
mod - docbook/Developers_Guide/en-US/Api_Rest.xml Diff File

MantisBT: master 9670defb

2026-09-03 19:17

dregad


Details Diff		 Send HTTP Deprecation header if bearer scheme missing

If the REST API authentication is provided without the bearer scheme, an
RFC 9745 Deprecation header is sent, together with a link to the
Developer's Guide REST API Authentication chapter.

Adapt PHPUnit testBareTokenIsAccepted() to check for presence of
Deprecation header.

Fixes 0035286		 Affected Issues
0035286
mod - api/rest/restcore/AuthMiddleware.php Diff File
mod - core/constant_inc.php Diff File
mod - tests/rest/RestAuthHeaderTest.php Diff File