Skip to main content
Version: 1.x

AUTH421: Auth token blocked by host

What this means​

The store's server is blocking the login token on every channel this app can use.

The app confirmed the store is reachable, but the server (or a firewall, proxy, or security plugin in front of it) strips the Authorization header and also blocks the token when it is sent as a URL parameter. There is no third way to deliver a login token, so this must be fixed on the server.

Your data​

No order or product data is affected.

Troubleshoot​

For your host / server — the login token has no delivery channel until the server passes it through:

  1. Allow the Authorization header through to WordPress — on Apache this is usually one line: SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1.
  2. If the site uses .htaccess rewrites, keep WordPress's generated RewriteRule line that passes HTTP_AUTHORIZATION — security plugins sometimes remove it.
  3. Behind a proxy or CDN, check its header allow-list: the Authorization request header must be forwarded to the origin.
  4. If a web application firewall (WAF) is filtering URL parameters, allow the authorization parameter on /wcpos/ REST routes.

Details​

Code
AUTH421 (AUTH_TOKEN_BLOCKED_BY_HOST)
Severity
error
Introduced in
WCPOS 1.10.0