使用Redmine API调用时遭遇401 Unauthorized错误求助

问题概述 #

使用cURL调用Redmine API时持续触发401未授权错误，已完成以下前置操作：

• 在【管理→设置→API】中启用REST API
• 确认使用的API Key正确无误
• 操作账号为系统管理员权限

环境版本信息 #

Environment:
  Redmine version                4.2.6.stable
  Ruby version                   2.7.6-p219 (2022-04-12) [x86_64-linux]
  Rails version                  5.2.8
  Environment                    production
  Database adapter               Mysql2
  Mailer queue                   ActiveJob::QueueAdapters::AsyncAdapter
  Mailer delivery                smtp
SCM:
  Subversion                     1.14.1
  Mercurial                      5.6.1
  Bazaar                         3.1.0
  Git                            2.30.2
  Filesystem                     
Redmine plugins:
  _query                         0.0.5
  additional_tags                1.0.4
  additionals                    3.0.5.2
  easy_baseline                  1.4
  easy_gantt                     1.13
  easy_gantt_pro                 1.10
  plantuml_macro                 0.0.1
  redmine_absolute_dates         0.0.4
  redmine_agile                  1.6.4
  redmine_checklists             3.1.21
  redmine_extended_reminder      0.0.2
  redmine_github_hook            3.0.1
  redmine_issue_evm              5.6.1
  redmine_issue_templates        1.1.0
  redmine_lightbox               1.0.1
  redmine_mermaid_macro          1.0.1
  redmine_messenger              1.0.13
  redmine_msteams                0.2.0
  redmine_searchable_selectbox   0.1.10
  redmine_serial_number_field    3.0.0
  redmine_slack                  0.2
  redmine_theme_changer          0.6.0
  redmine_wiki_extensions        0.9.4
  redmine_wiki_lists             0.0.11
  redmine_work_time              0.4.1
  view_customize                 3.1.0

成功调用示例（账号密码认证） #

curl -sS -X GET -u john.smith@test.co.jp:password \
   'https://project-redmine.test.co.jp/test/projects.json'

失败场景 #

场景1：通过请求头传递API Key #

curl -sS -X GET -H 'X-Redmine-API-Key:here-is-key' \
    'https://project-redmine.test.co.jp/test/projects.json'

返回结果：

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>

场景2：通过URL参数传递API Key #

curl -sS -X GET 'https://project-redmine.test.co.jp/test/projects.json?key=here-is-key'

返回结果：

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>

排查方向 #

• 确认请求路径：检查URL中的/test是否为Redmine的正确部署子路径，尝试去掉该路径后重新请求
• 验证API Key有效性：在管理员账号的个人设置页重新生成API Key，替换后测试
• 检查Web服务器配置：确认Nginx/Apache等前端服务器未拦截X-Redmine-API-Key请求头或keyURL参数
• 排查插件冲突：临时禁用所有第三方插件，测试API调用是否恢复正常
• 核对API设置：检查Redmine的API设置页面，确认是否有额外的API认证开关未启用

内容的提问来源于stack exchange，提问作者M.Nada