Legacy /api/ handlers panic on unauthenticated requests instead of returning 401

Author: ZeidMahmoudCreated Aug 16, 2026Updated Aug 16, 2026

Labelstype:bug

Version

v1.8.0, linux/amd64, SQLite, running behind nginx

What happens

An unauthenticated request to a legacy /api/ endpoint panics in ApiGetBookmarks rather than returning 401 Unauthorized. nginx reports "upstream prematurely closed connection".

Reproduce

bash

curl -s -o /dev/null -w "%{http_code}\n" \
  http://127.0.0.1:9090/api/bookmarks

Stack trace

panic: ...
github.com/go-shiori/shiori/internal/webserver.checkError(...)
    /home/runner/work/shiori/shiori/internal/webserver/utils.go:29
github.com/go-shiori/shiori/internal/webserver.(*Handler).ApiGetBookmarks(0xc0001c4ee0, ...)
    /home/runner/work/shiori/shiori/internal/webserver/handler-api.go:52 +0x1025
github.com/go-shiori/shiori/internal/http/handlers.(*LegacyHandler).HandleGetBookmarks(...)
    /home/runner/work/shiori/shiori/internal/http/handlers/legacy.go:79 +0x97
github.com/go-shiori/shiori/internal/http.(*HttpServer).Setup.ToHTTPHandler.func11(...)
    /home/runner/work/shiori/shiori/internal/http/http.go:26 +0x17d
net/http.HandlerFunc.ServeHTTP(...)
    /opt/hostedtoolcache/go/1.23.6/x64/src/net/http/server.go:2220 +0x29

Expected

401 Unauthorized with a JSON error body, as the /api/v1/ endpoints return.

/bookmark/{id}/thumb also redirects to the login page even when given a valid Bearer token obtained from /api/v1/auth/login. Both appear to be auth handling problems specific to the legacy routes.

Source: go-shiori/shiori