The MantisBT REST API is currently not returning the expected API response when an API token is provided through the Authorization header.

When calling the REST API with a valid API token, the request is redirected to the Mantis login page instead of returning the requested API data.

API Request

curl -i \
  -H "Authorization: YOUR_VALID_API_TOKEN" \
  "http://support.svaapta.com/api/rest/index.php/projects"

Current Response

HTTP/1.1 302 Found
Location: http://support.svaapta.com/login_page.php?return=api%2Frest%2Findex.php

Expected Response

The API should authenticate the user using the supplied API token and return the requested project data, for example:

HTTP/1.1 200 OK
Content-Type: application/json

with the project information in the response body.

Investigation Performed

The following checks have been completed:

1. The Authorization header is successfully reaching PHP.

HTTP_AUTHORIZATION=<token>
Authorization => <token>

2. The REST index.php is being executed successfully.

REST INDEX EXECUTED

3. AuthMiddleware.php is successfully loaded.

AUTH MIDDLEWARE FILE LOADED

4. The API token was independently validated using MantisBT's api_token_get_user() function.

Token length: 32
User ID: 534

5. The token successfully maps to the MantisBT user.

Username: hetal.parmar

6. mci_check_login() also successfully authenticates the user.

mci_check_login: 534

7. The following REST middleware files were reviewed:

   • CacheMiddleware.php
   • OfflineMiddleware.php
   • VersionMiddleware.php
   • AuthMiddleware.php

8. The REST API is enabled in MantisBT configuration:

$g_webservice_rest_enabled = ON;

Environment

• MantisBT REST API
• PHP 8.1.x
• Apache
• OpenResty / Nginx reverse proxy
• Docker
• Slim Framework 3.x
• API token authentication

Technical Observation

The API token itself is valid and the Authorization header reaches the REST endpoint correctly.

However, the request ultimately receives a 302 redirect to:

login_page.php?return=api/rest/index.php

This redirect is unexpected for an API-token-authenticated REST request.

AuthMiddleware normally returns 401 or 403 for authentication/authorization failures rather than a 302 login redirect.

Impact

REST API clients are currently unable to reliably access MantisBT REST endpoints using API token authentication.

This affects API integrations that depend on endpoints such as:

/api/rest/index.php/projects

Next Investigation

Trace the Slim middleware execution order and identify which component/code is generating the 302 redirect to login_page.php.

The following should be investigated:

• AuthMiddleware execution
• Slim middleware stack
• ApiEnabledMiddleware
• Mantis authentication/redirect functions
• Any customizations or plugins that may trigger login redirects
• Source of login_page.php?return=api/rest/index.php

Expected Resolution

The REST API should accept a valid API token from the Authorization header and return the requested API response without redirecting the request to the MantisBT login page.