Error 401 when trying to download a share protected with password

[M4th12]

When I try to create a share protected with a password I get this error in the console browser, trying without a password work just fine. (Tried with different browser but the problem persist)

I also founded that if you are logged with an account on Palmr this problem doesn't appear.

/api/shares/alias/get/hvBAmMLdX1:1 Failed to load resource: the server responded with a status of 400 () 3799-dcd8074c5d2fbfd2.js:1 Warning: MissingDescriptionoraria-describedby={undefined}for {DialogContent}. (anonymous) @ 3799-dcd8074c5d2fbfd2.js:1 /api/files/download-url?objectName=cmkrj4rbc0000p80ktb98opaz%2F1769448859479-pnit9-tOD0R7XjO8a8.yaml:1 Failed to load resource: the server responded with a status of 401 () 4123-dde464ceffc887a5.js:1 Error downloading file: z push.16102.window.console.error @ 4123-dde464ceffc887a5.js:1 268-79625592b124beb8.js:1 GET https://palmr.example.com/api/files/download-url?objectName=cmkrj4rbc0000p80ktb98opaz%2F1769448859479-pnit9-tOD0R7XjO8a8.yaml 401 (Unauthorized) (anonymous) @ 268-79625592b124beb8.js:1 xhr @ 268-79625592b124beb8.js:1 e7 @ 268-79625592b124beb8.js:1 _request @ 268-79625592b124beb8.js:1 request @ 268-79625592b124beb8.js:1 (anonymous) @ 268-79625592b124beb8.js:1 (anonymous) @ 268-79625592b124beb8.js:1 l @ 8452-f97494c1e1dc4e0e.js:1 getCachedDownloadUrl @ 7727-4237f47c4fc1ac7e.js:1 O @ page-9b9cca3003e40f26.js:1 onClick @ 5396-83e980bbe68fe8d7.js:1 iX @ fb8bf863-d60538aaa1d9fbe5.js:1 (anonymous) @ fb8bf863-d60538aaa1d9fbe5.js:1 nS @ fb8bf863-d60538aaa1d9fbe5.js:1 i2 @ fb8bf863-d60538aaa1d9fbe5.js:1 s7 @ fb8bf863-d60538aaa1d9fbe5.js:1 s5 @ fb8bf863-d60538aaa1d9fbe5.js:1 4123-dde464ceffc887a5.js:1 Error downloading file: z {message: 'Request failed with status code 401', name: 'AxiosError', code: 'ERR_BAD_REQUEST', config: {…}, request: XMLHttpRequest, …}code: "ERR_BAD_REQUEST"config: {transitional: {…}, adapter: Array(3), transformRequest: Array(1), transformResponse: Array(1), timeout: 120000, …}message: "Request failed with status code 401"name: "AxiosError"request: XMLHttpRequest {onreadystatechange: null, readyState: 4, timeout: 120000, withCredentials: true, upload: XMLHttpRequestUpload, …}response: {data: {…}, status: 401, statusText: '', headers: e_, config: {…}, …}status: 401stack: "AxiosError: Request failed with status code 401\n at eL (https://palmr.example.com/_next/static/chunks/268-79625592b124beb8.js:1:16912)\n at XMLHttpRequest.g (https://palmr.example.com/_next/static/chunks/268-79625592b124beb8.js:1:21359)\n at to.request (https://palmr.example.com/_next/static/chunks/268-79625592b124beb8.js:1:29487)\n at async r.getCachedDownloadUrl (https://palmr.example.com/_next/static/chunks/7727-4237f47c4fc1ac7e.js:1:1767)\n at async O (https://palmr.example.com/_next/static/chunks/app/(shares)/s/%5Balias%5D/page-9b9cca3003e40f26.js:1:10492)"[[Prototype]]: Error push.16102.window.console.error @ 4123-dde464ceffc887a5.js:1 O @ page-9b9cca3003e40f26.js:1 await in O onClick @ 5396-83e980bbe68fe8d7.js:1 iX @ fb8bf863-d60538aaa1d9fbe5.js:1 (anonymous) @ fb8bf863-d60538aaa1d9fbe5.js:1 nS @ fb8bf863-d60538aaa1d9fbe5.js:1 i2 @ fb8bf863-d60538aaa1d9fbe5.js:1 s7 @ fb8bf863-d60538aaa1d9fbe5.js:1 s5 @ fb8bf863-d60538aaa1d9fbe5.js:1

[Haypepito]

Same issue

[graphixillusion]

Same issue on my end too.

[PTTechie]

same issue here too, i've been trying to get this to work for days now, the only time I can get it to work is if I'm logged into my account, then go to the file share page, enter the password and then it works, but only when I'm logged in or if the password is removed, otherwise I get the same problem, no preview and it won't download.

[robinogi]

Me too. I've just installed and configured, and I assumed I had done something wrong.

[qcdesign]

We’re seeing the same behaviour.

Public share links with a password fail with 401 Unauthorized when the user is not logged in, even though the frontend correctly sends the x-share-password header.

As soon as you log into any account, the exact same link works - which suggests to me that /api/files/download-url is still protected by auth middleware and guest requests never reach the share-password validation logic.

In other words, the flow currently looks like:

auth guard → 401

instead of:

if (user) allow
else if (share password valid) allow
else deny

So for guests, the backend rejects the request before checking the share password.

Fix i think would be to allow this endpoint to bypass auth and explicitly support either:

• authenticated user
OR
• valid x-share-password

Something along the lines of:

if (!user) {
  if (!sharePassword) return 401
  if (!isValidSharePassword) return 403
}

I would do a pull req but i'm not so good with typescript yet! only know a bit from setting up middleware in our nuxt.js/vue apps.

Either way thanks for your project, liking it other than being a bit confused by this