Home / Help centre / Results & findings
Results & findings
What does "No auth header was attached to the proving request." mean?
The line on the Evidence tab is a note, not a fault. It says the request that proved the finding carried no auth header. The scan showed the issue without any sign-in, as with an open search form. It tells you what access the proof needed.
Why this happens
It is information, and nothing needs fixing. The first line of the Evidence tab states which role or header, if any, the proving request used. Here, there was none. It proved the issue with an anonymous request, the kind any visitor to the site could send from a browser or a script.
How proof requests work
When an exploitation agent proves a finding, it sends real requests to the running app and records every one of them, along with what came back. The Authentication line tells you whose access that request used. One captured example is a SQL injection in a search form. It worked with no header at all, which is why the note appears.
| Authentication line says | It means |
|---|---|
| No auth header was attached | The proof worked with no sign-in |
| A role or header is named | The proof used that role's access |
Pair the note with the severity. An issue that works with no sign-in is within reach of anyone who can load the URL. That is often more urgent than one that needs a login first.
The same note also appears when a profile has no authentication roles. Such a profile scans without signing in at all, and the profile page says so with its empty state, "No auth roles".
How to fix it
- Check the HTTP request block below the note. No
Authorizationor cookie line should appear. - Did you expect a signed-in test? Open the profile and look at Authentication, then add a role if the app needs a login to reach that page.
- Run the curl steps under Reproduction steps, but only on systems you have permission to test.
Still not working?
Our page on viewing the request and response shows the blocks. See also unauthenticated scans. Need more? Contact us. The tutorial on reading a finding goes through every field.
Related questions
- How do I see the HTTP request and response that proved a finding?
- How do I run a scan without any login?
- How do I see the exact payload used to prove a finding?
- How do I add a login role to a scan profile?
- How do I reproduce a finding myself?
How to read a finding in Cyberlop: Summary and Evidence
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.