Skip to content

fix[faustwp-cli]: (#1850) detect HTTP Basic Auth and show accurate error#2316

Open
latenighthackathon wants to merge 2 commits intowpengine:canaryfrom
latenighthackathon:fix/faustwp-cli-basic-auth-error
Open

fix[faustwp-cli]: (#1850) detect HTTP Basic Auth and show accurate error#2316
latenighthackathon wants to merge 2 commits intowpengine:canaryfrom
latenighthackathon:fix/faustwp-cli-basic-auth-error

Conversation

@latenighthackathon
Copy link
Copy Markdown
Contributor

Description

When a WordPress site is protected with HTTP Basic Authentication, the secret key validation request returns a 401 from the web server (Apache/Nginx), not from FaustWP. The health check assumed any 401 meant the secret key was wrong, showing a misleading error:

Ensure your FAUST_SECRET_KEY environment variable matches your Secret Key in the Faust WordPress plugin settings

This PR checks the WWW-Authenticate response header for Basic to distinguish between HTTP Basic Auth (web server blocking the request) and a genuine secret key mismatch (FaustWP rejecting the key). Each case now shows an accurate error message.

Related Issues

Closes #1850

Testing

Confirm the issue (before the fix)

1. Verify the health check does not distinguish Basic Auth from secret key mismatch:

grep -A 5 'response.status === 401' packages/faustwp-cli/src/healthCheck/validateFaustEnvVars.ts
# Expected on canary: single error message about FAUST_SECRET_KEY, no WWW-Authenticate check

Confirm the fix

2. Verify the health check now checks WWW-Authenticate header:

grep -A 12 'response.status === 401' packages/faustwp-cli/src/healthCheck/validateFaustEnvVars.ts
# Expected: wwwAuth check for 'basic', two different error paths

3. Verify the new test case passes:

npx jest --config packages/faustwp-cli/jest.config.js --verbose -- validateFaustEnvVars
# Expected: 6 tests pass, including "logs a Basic Auth error when the site returns 401 with WWW-Authenticate: Basic"

4. Verify the existing 401 test still passes (secret key mismatch without Basic Auth):

npx jest --config packages/faustwp-cli/jest.config.js --verbose -- validateFaustEnvVars
# Expected: "logs an error when the secret key validation fails" still passes

Run the test suites

CLI tests:

npx jest --config packages/faustwp-cli/jest.config.js

Full JS tests:

npm install && npm run build && npm run test

…urate error

When a WordPress site is protected with HTTP Basic Authentication,
the secret key validation request returns 401 from the web server,
not from FaustWP. The health check assumed any 401 meant the secret
key was wrong, showing a misleading error message.

Check the WWW-Authenticate response header for "Basic" to distinguish
HTTP Basic Auth (web server) from a secret key mismatch (plugin).
Show a specific error message telling the user their site has Basic
Auth protection.

Closes wpengine#1850
@latenighthackathon latenighthackathon requested a review from a team as a code owner April 3, 2026 05:09
@headless-platform-by-wp-engine
Copy link
Copy Markdown

Currently, we do not support the creation of preview deployments based on changes coming from forked repositories.
Learn more about preview environments in our documentation.

@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Apr 3, 2026

🦋 Changeset detected

Latest commit: a175382

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@faustwp/cli Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-project-automation github-project-automation bot moved this to 🆕 Backlog in Headless OSS Apr 3, 2026
@ahuseyn ahuseyn moved this from 🆕 Backlog to 👀 In review in Headless OSS Apr 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 👀 In review

Development

Successfully merging this pull request may close these issues.

Faust gives incorrect error when site is password protected with http basic auth

2 participants