httpAction Authorization Bearer is broken

[adelin-b]

Hello, its is not possible to auth using httpAction

  useEffect(() => {
    const fetchData = async () => {
      const token = await authData.getToken();
      const response = await fetch(`${CONVEX_SITE_URL}/api/chat`, {
        method: "POST",
        body: JSON.stringify({ messages: [] }),
        headers: {
          Authorization: `Bearer ${token}`,
        },
      });
      console.log(response);
    };
    fetchData();
  }, [token]);

Will have no more Authorization headers inside the req once it reach httpAction and no identiry

export const chat = httpAction(async (ctx: ActionCtx, req) => {
  // Extract the `messages` and organizationId from the body of the request
  const { messages, organizationId } = await req.json();
  const userIdentity = await ctx.auth.getUserIdentity(); // This is null NULL
}

But on the doc it says it should. https://docs.convex.dev/auth/functions-auth#http-actions

You can also access the user identity from an HTTP action ctx.auth.getUserIdentity(), by calling your endpoint with an Authorization header including a JWT token:

myPage.ts

const jwtToken = "...";

fetch("https://<deployment name>.convex.site/myAction", {
  headers: {
    Authorization: `Bearer ${jwtToken}`,
  },
});

[Albertcharlestravels]

export const chat = httpAction(async (ctx: ActionCtx, req) => { // Extract the `messages` and organizationId from the body of the request const { messages, organizationId } = await req.json(); // If you don't want to use authentication tokens, you'll need to find another way // to identify and potentially authorize users. // Example: Using an API key passed in the request headers const apiKey = req.headers.get("X-API-Key"); if (!apiKey) { return new Response(JSON.stringify({ error: "API Key Required" }), { status: 401, headers: { "Content-Type": "application/json" }, }); } // Example: Validate the API key against a database or configuration const isValidApiKey = await validateApiKey(apiKey); // Replace with your validation logic if (!isValidApiKey) { return new Response(JSON.stringify({ error: "Invalid API Key" }), { status: 403, // Forbidden headers: { "Content-Type": "application/json" }, }); } // Example: If using API key, you might associate the key with a user or organization const userId = await getUserIdFromApiKey(apiKey); // Replace with your logic. // Proceed with chat processing using the extracted data console.log(`Organization ID: ${organizationId}`); console.log(`Messages: ${JSON.stringify(messages)}`); console.log(`User ID: ${userId}`); // Example: Respond with a success message. return new Response(JSON.stringify({ message: "Chat processed successfully", userId: userId }), { status: 200, headers: { "Content-Type": "application/json" }, }); // Example error handling // try { // // ... your logic ... // } catch (error) { // console.error("Error processing chat:", error); // return new Response(JSON.stringify({ error: "Internal Server Error" }), { // status: 500, // headers: { "Content-Type": "application/json" }, // }); // } }); // Placeholder functions - replace with your actual logic async function validateApiKey(apiKey: string): Promise<boolean> { // Implement your API key validation here (e.g., check against a database). // This is just a placeholder. return apiKey === "your-valid-api-key"; // Example: replace with actual validation. } async function getUserIdFromApiKey(apiKey: string): Promise<string> { // Implement logic to retrieve a user ID associated with the API key. // This is just a placeholder. return "user123"; // Example: replace with actual retrieval. }

…

On Sun, Mar 9, 2025, 8:36 PM Adelin Berard ***@***.***> wrote: Hello, its is not possible to auth using httpAction useEffect(() => { const fetchData = async () => { const token = await authData.getToken(); const response = await fetch(`${CONVEX_SITE_URL}/api/chat`, { method: "POST", body: JSON.stringify({ messages: [] }), headers: { Authorization: `Bearer ${token}`, }, }); console.log(response); }; fetchData(); }, [token]); Will have no more Authorization headers inside the req once it reach httpAction and no identiry export const chat = httpAction(async (ctx: ActionCtx, req) => { // Extract the `messages` and organizationId from the body of the request const { messages, organizationId } = await req.json(); const userIdentity = await ctx.auth.getUserIdentity(); // This is null NULL} But on the doc it says it should. https://docs.convex.dev/auth/functions-auth#http-actions You can also access the user identity from an HTTP action ctx.auth.getUserIdentity() <https://docs.convex.dev/api/interfaces/server.Auth#getuseridentity>, by calling your endpoint with an Authorization header including a JWT token: myPage.ts const jwtToken = "..."; fetch("https://<deployment name>.convex.site/myAction", { headers: { Authorization: `Bearer ${jwtToken}`, }, }); — Reply to this email directly, view it on GitHub <#58>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3Z3QCUPAM2WEVIZXUXPYHT2TR33VAVCNFSM6AAAAABYUPMNUWVHI2DSMVQWIX3LMV43ASLTON2WKOZSHEYDKNJWGU2TAMQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***> [image: adelin-b]*adelin-b* created an issue (get-convex/convex-backend#58) <#58> Hello, its is not possible to auth using httpAction useEffect(() => { const fetchData = async () => { const token = await authData.getToken(); const response = await fetch(`${CONVEX_SITE_URL}/api/chat`, { method: "POST", body: JSON.stringify({ messages: [] }), headers: { Authorization: `Bearer ${token}`, }, }); console.log(response); }; fetchData(); }, [token]); Will have no more Authorization headers inside the req once it reach httpAction and no identiry export const chat = httpAction(async (ctx: ActionCtx, req) => { // Extract the `messages` and organizationId from the body of the request const { messages, organizationId } = await req.json(); const userIdentity = await ctx.auth.getUserIdentity(); // This is null NULL} But on the doc it says it should. https://docs.convex.dev/auth/functions-auth#http-actions You can also access the user identity from an HTTP action ctx.auth.getUserIdentity() <https://docs.convex.dev/api/interfaces/server.Auth#getuseridentity>, by calling your endpoint with an Authorization header including a JWT token: myPage.ts const jwtToken = "..."; fetch("https://<deployment name>.convex.site/myAction", { headers: { Authorization: `Bearer ${jwtToken}`, }, }); — Reply to this email directly, view it on GitHub <#58>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3Z3QCUPAM2WEVIZXUXPYHT2TR33VAVCNFSM6AAAAABYUPMNUWVHI2DSMVQWIX3LMV43ASLTON2WKOZSHEYDKNJWGU2TAMQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Albertcharlestravels]

Input <script> function extractDomain(url) { try { const parsedUrl = new URL(url); return parsedUrl.hostname; } catch (e) { return null; // Invalid URL } } function handleInput() { const inputUrl = document.getElementById("urlInput").value; const domain = extractDomain(inputUrl); const resultElement = document.getElementById("result"); if (domain) { resultElement.textContent = "Domain: " + domain; } else { resultElement.textContent = "Invalid URL or Domain not found."; } } </script> <input type="text" id="urlInput" placeholder="Enter URL"> <button onclick="handleInput()">Get Domain</button> <p id="result"></p> On Sun, Mar 9, 2025, 10:15 PM Albert charles ***@***.***> wrote:

…

export const chat = httpAction(async (ctx: ActionCtx, req) => { // Extract the `messages` and organizationId from the body of the request const { messages, organizationId } = await req.json(); // If you don't want to use authentication tokens, you'll need to find another way // to identify and potentially authorize users. // Example: Using an API key passed in the request headers const apiKey = req.headers.get("X-API-Key"); if (!apiKey) { return new Response(JSON.stringify({ error: "API Key Required" }), { status: 401, headers: { "Content-Type": "application/json" }, }); } // Example: Validate the API key against a database or configuration const isValidApiKey = await validateApiKey(apiKey); // Replace with your validation logic if (!isValidApiKey) { return new Response(JSON.stringify({ error: "Invalid API Key" }), { status: 403, // Forbidden headers: { "Content-Type": "application/json" }, }); } // Example: If using API key, you might associate the key with a user or organization const userId = await getUserIdFromApiKey(apiKey); // Replace with your logic. // Proceed with chat processing using the extracted data console.log(`Organization ID: ${organizationId}`); console.log(`Messages: ${JSON.stringify(messages)}`); console.log(`User ID: ${userId}`); // Example: Respond with a success message. return new Response(JSON.stringify({ message: "Chat processed successfully", userId: userId }), { status: 200, headers: { "Content-Type": "application/json" }, }); // Example error handling // try { // // ... your logic ... // } catch (error) { // console.error("Error processing chat:", error); // return new Response(JSON.stringify({ error: "Internal Server Error" }), { // status: 500, // headers: { "Content-Type": "application/json" }, // }); // } }); // Placeholder functions - replace with your actual logic async function validateApiKey(apiKey: string): Promise<boolean> { // Implement your API key validation here (e.g., check against a database). // This is just a placeholder. return apiKey === "your-valid-api-key"; // Example: replace with actual validation. } async function getUserIdFromApiKey(apiKey: string): Promise<string> { // Implement logic to retrieve a user ID associated with the API key. // This is just a placeholder. return "user123"; // Example: replace with actual retrieval. } On Sun, Mar 9, 2025, 8:36 PM Adelin Berard ***@***.***> wrote: > Hello, its is not possible to auth using httpAction > > useEffect(() => { > const fetchData = async () => { > const token = await authData.getToken(); > const response = await fetch(`${CONVEX_SITE_URL}/api/chat`, { > method: "POST", > body: JSON.stringify({ messages: [] }), > headers: { > Authorization: `Bearer ${token}`, > }, > }); > console.log(response); > }; > fetchData(); > }, [token]); > > Will have no more Authorization headers inside the req once it reach > httpAction and no identiry > > export const chat = httpAction(async (ctx: ActionCtx, req) => { > // Extract the `messages` and organizationId from the body of the request > const { messages, organizationId } = await req.json(); > const userIdentity = await ctx.auth.getUserIdentity(); // This is null NULL} > > But on the doc it says it should. > https://docs.convex.dev/auth/functions-auth#http-actions > > You can also access the user identity from an HTTP action > ctx.auth.getUserIdentity() > <https://docs.convex.dev/api/interfaces/server.Auth#getuseridentity>, by > calling your endpoint with an Authorization header including a JWT token: > > myPage.ts > > const jwtToken = "..."; > > fetch("https://<deployment name>.convex.site/myAction", { > headers: { > Authorization: `Bearer ${jwtToken}`, > }, > }); > > — > Reply to this email directly, view it on GitHub > <#58>, or unsubscribe > <https://github.com/notifications/unsubscribe-auth/A3Z3QCUPAM2WEVIZXUXPYHT2TR33VAVCNFSM6AAAAABYUPMNUWVHI2DSMVQWIX3LMV43ASLTON2WKOZSHEYDKNJWGU2TAMQ> > . > You are receiving this because you are subscribed to this thread.Message > ID: ***@***.***> > [image: adelin-b]*adelin-b* created an issue > (get-convex/convex-backend#58) > <#58> > > Hello, its is not possible to auth using httpAction > > useEffect(() => { > const fetchData = async () => { > const token = await authData.getToken(); > const response = await fetch(`${CONVEX_SITE_URL}/api/chat`, { > method: "POST", > body: JSON.stringify({ messages: [] }), > headers: { > Authorization: `Bearer ${token}`, > }, > }); > console.log(response); > }; > fetchData(); > }, [token]); > > Will have no more Authorization headers inside the req once it reach > httpAction and no identiry > > export const chat = httpAction(async (ctx: ActionCtx, req) => { > // Extract the `messages` and organizationId from the body of the request > const { messages, organizationId } = await req.json(); > const userIdentity = await ctx.auth.getUserIdentity(); // This is null NULL} > > But on the doc it says it should. > https://docs.convex.dev/auth/functions-auth#http-actions > > You can also access the user identity from an HTTP action > ctx.auth.getUserIdentity() > <https://docs.convex.dev/api/interfaces/server.Auth#getuseridentity>, by > calling your endpoint with an Authorization header including a JWT token: > > myPage.ts > > const jwtToken = "..."; > > fetch("https://<deployment name>.convex.site/myAction", { > headers: { > Authorization: `Bearer ${jwtToken}`, > }, > }); > > — > Reply to this email directly, view it on GitHub > <#58>, or unsubscribe > <https://github.com/notifications/unsubscribe-auth/A3Z3QCUPAM2WEVIZXUXPYHT2TR33VAVCNFSM6AAAAABYUPMNUWVHI2DSMVQWIX3LMV43ASLTON2WKOZSHEYDKNJWGU2TAMQ> > . > You are receiving this because you are subscribed to this thread.Message > ID: ***@***.***> >

[nipunn1313]

I was able to get it working with clerk.

function Content() {
  const messages = useQuery(api.messages.list) || [];
  const [newMessageText, setNewMessageText] = useState("");
  const sendMessage = useMutation(api.messages.send);
  const { getToken } = useAuth();

  async function handleSendMessage(event: FormEvent) {
    event.preventDefault();
    await sendMessage({ body: newMessageText });
    setNewMessageText("");
  }

  async function handleDoHttpAction(event: FormEvent) {
    event.preventDefault();
    try {
      const token = await getToken({
        template: "convex",
      });
      const response = await fetch("http://localhost:8001/hello", {
        headers: {
          Authorization: `Bearer ${token}`,
        },
      });
      console.log(response);
      const text = await response.text();
      console.log(text);
    } catch (error) {
      console.error("Error fetching data:", error);
    }
  }

  return (
    <main>
      <h1>Convex Chat</h1>
      <Badge />
      <h2>
        <SignOutButton />
      </h2>
      <ul>
        {messages.map((message) => (
          <li key={message._id}>
            <span>{message.author}:</span>
            <span>{message.body}</span>
            <span>{new Date(message._creationTime).toLocaleTimeString()}</span>
          </li>
        ))}
      </ul>
      <form onSubmit={handleSendMessage}>
        <input
          value={newMessageText}
          onChange={(event) => setNewMessageText(event.target.value)}
          placeholder="Write a message…"
        />
        <input type="submit" value="Send" disabled={newMessageText === ""} />
      </form>

      <form onSubmit={handleDoHttpAction}>
        <input type="submit" value="DoHttpAction" />
      </form>
    </main>
  );
}

I did notice that if there were any errors in parsing/evaluating the JWT, the error didn't propagate in a way that you could observe it (it just comes as null). I was able to debug by building backend from source and looking at backend logs. This is the key line - you can see where the error is being eaten.

convex-backend/crates/local_backend/src/http_actions.rs

Line 197 in 29dd36f

let identity = identity_result.unwrap_or(Identity::Unknown);

I am looking into that now - because getting better error messages on bad Authorization headers would be useful.

[nipunn1313]

Hi! We made some changes that should give better error messages if the Authorization header passed up has any issues. That way instead of it mysteriously not working, you'll be able to get an error message.

I'm hopeful that will resolve it for you - but please feel free to reopen or file a new issue if there are more issues.