http-auth
Rejects requests without credentials
shipped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain http-auth.
- pack
http- weight
- scored
- scope
- server as deployed (is the configured credential actually required?)
- decided by
- http
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
checks.http-auth.enabledchecks.http-auth.severityserver.headers
Probes
no-credentialsinitialize and tools/list sent without any of the configured headers
Settings and thresholds
Every check also takes checks.http-auth.enabled and checks.http-auth.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
server.headers | none | not locked | HTTP headers sent to the server (url transport). Values under secret-looking names are redacted. |
How the verdict is established
- Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.
What to fix
Require a credential on every request and answer 401 when it is missing or invalid; do not treat a routing header as authentication.
False positives
A server whose configured header is not a credential (a routing header) is treated as having none: only headers whose names look like credentials count.
False negatives
Credentials that are valid but under-scoped, tokens that never expire, authorization of individual tools.