fix: add proper error handling for missing authorization header (#11096)

[zendy199x]

Fixes #11096

Why / What / How

The current authentication dependencies likely raise an ApiError when the Authorization header is missing, but the error message may not be clear or the header extraction logic may not be robust. This change improves header extraction and provides clearer, more actionable error messages.

This PR refactors the authorization header extraction logic in dependencies.py to add proper error handling for missing or malformed Authorization headers, ensuring consistent and informative error responses.

The change introduces explicit checks for the presence and format of the Authorization header before attempting to parse it. If the header is missing, a descriptive error is raised with a clear message indicating the expected format. The implementation avoids relying on implicit behavior or generic exceptions.

Changes 🏗️

• Updated autogpt_platform/autogpt_libs/autogpt_libs/auth/dependencies.py to:
  • Explicitly check for the presence of the Authorization header
  • Provide a clear error message when the header is missing
  • Improve robustness of header parsing logic

Checklist 📋

For code changes:

• I have clearly listed my changes in the PR description
• I have made a test plan
• I have tested my changes according to the test plan:
  • ...

For configuration changes:

• .env.default is updated or already compatible with my changes
• docker-compose.yml is updated or already compatible with my changes
• I have included a list of my configuration changes in the PR description (under Changes)

[github-actions]

This PR targets the master branch but does not come from dev or a hotfix/* branch.

Automatically setting the base branch to dev.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f75b8491-a0e1-44a3-9816-e19a2073b196

📥 Commits

Reviewing files that changed from the base of the PR and between 46932df and df397c3.

📒 Files selected for processing (2)

• autogpt_platform/autogpt_libs/autogpt_libs/auth/dependencies.py
• autogpt_platform/frontend/Dockerfile

✅ Files skipped from review due to trivial changes (1)

• autogpt_platform/frontend/Dockerfile

🚧 Files skipped from review as they are similar to previous changes (1)

• autogpt_platform/autogpt_libs/autogpt_libs/auth/dependencies.py

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (9)

• GitHub Check: check API types
• GitHub Check: end-to-end tests
• GitHub Check: Seer Code Review
• GitHub Check: test (3.13)
• GitHub Check: test (3.12)
• GitHub Check: type-check (3.12)
• GitHub Check: test (3.11)
• GitHub Check: Analyze (python)
• GitHub Check: Check PR Status

---

Walkthrough

Auth dependency now treats requests as anonymous when credential details are missing and disables admin impersonation if the X-Act-As-User-Id header, after trimming, equals "none" (case-insensitive). Frontend production Docker base image updated to node:22.22-alpine3.23.

Changes

Cohort / File(s)	Summary
Authentication Handling autogpt_platform/autogpt_libs/autogpt_libs/auth/dependencies.py	Return None when credentials or credentials.credentials is absent (log debug); treat trimmed X-Act-As-User-Id == "none" (case-insensitive) as disabling admin impersonation.
Frontend Dockerfile autogpt_platform/frontend/Dockerfile	Production stage base image changed from node:21-alpine to node:22.22-alpine3.23; no other production-stage instructions altered.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat(platform): implement admin user impersonation with header-based authentication #11298 — makes closely related edits to admin impersonation and handling of an explicit "none" X-Act-As-User-Id header.

Suggested labels

Possible security concern, Review effort 3/5

Poem

🐰 I sniff the headers, trim the fluff,

"none" hops past — I call that enough.
When creds are hiding, I tiptoe by,
Quiet paws beneath a debug sky,
A tiny rabbit guards the auth stuff!

🚥 Pre-merge checks | ✅ 1 | ❌ 4

❌ Failed checks (3 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title describes a code change (adding error handling for missing authorization header) but the actual changes include modifying JWT parsing behavior and updating a Docker base image, which aren't mentioned in the title.	Update the title to reflect the actual changes made, such as 'fix: improve authorization header handling and update Node.js version' or split into focused PRs.
Description check	⚠️ Warning	The description claims to refactor authorization header extraction with explicit checks and error messages, but the actual changes show modifications to JWT parsing logic and Docker base image updates that aren't described.	Update the description to accurately reflect changes to both authentication logic and Docker configuration, or separate these changes into distinct pull requests.
Out of Scope Changes check	⚠️ Warning	The Dockerfile change updating Node.js from version 21 to 22.22 is unrelated to the stated objective of fixing authorization header error handling.	Remove the Dockerfile change or create a separate PR for the Node.js version update, as it is outside the scope of fixing authorization header handling.
Linked Issues check	❓ Inconclusive	Issue #11096 requires handling missing authorization headers, but the PR changes show modifications to JWT credentials handling and Docker image version without explicit error handling for missing headers.	Clarify whether the PR fully addresses issue #11096's requirements and verify that the authorization header handling matches the issue's specifications.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Refines authentication-related dependency behavior in the platform auth library and (separately) updates the frontend Docker image base.

Changes:

• Adjust get_optional_user_id to treat missing/empty bearer credentials as anonymous access.
• Treat X-Act-As-User-Id: none (case-insensitive) as “no impersonation”.
• Update autogpt_platform/frontend Dockerfile base/prod images to Node 22.22 on Alpine 3.23.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
autogpt_platform/frontend/Dockerfile	Updates Node/Alpine base images used to build and run the frontend container.
autogpt_platform/autogpt_libs/autogpt_libs/auth/dependencies.py	Tightens optional auth credential handling and adds an impersonation-header sentinel behavior.