A Basic authentication dialog over the OAuth consent screen, and 401s on prefetch requests

Summary

In the staging environment of a service I develop at my own company, a Basic authentication dialog appeared over the OAuth consent screen, even though the consent screen was excluded from Basic authentication. The consent screen sent requests of two kinds, for an icon and for prefetching, and both kinds reached paths that were not on the exclusion list, so all of them received a 401. In the third fix, the AI agent that did the implementation used the value of the Sec-Fetch-Mode header to decide whether a 401 response includes a WWW-Authenticate header.

In the second fix, the AI agent that did the implementation added a check based on the RSC headers attached to prefetch requests. All 34 tests that call the middleware function directly passed. However, the adapter in Next.js that passes requests to the middleware removes the RSC headers before passing them on. As a result, when a request goes through the adapter, the check from the second fix does not take effect.

In my check on 2026-09-30, the staging environment returned the responses that the third fix was designed to return for four kinds of requests. This check does not tell whether the dialog stopped appearing on the consent screen in the mobile app of the external OAuth client.

What you can take away

This article is for people who protect a staging environment with Basic authentication while building a service that accepts connections from outside, such as OAuth.

• A breakdown of how the icon request and the prefetch requests sent by a page excluded from Basic authentication still received a 401.
• A fix that uses the value of the Sec-Fetch-Mode header to decide whether a 401 response includes a WWW-Authenticate header, and the point on which that 401 violates RFC 9110.
• The check that tests calling the middleware function directly missed, compared with a test that goes through the adapter.

The sources for this article are the service’s PR, commits, and tests, and the documents that set out its rules for review and merging, along with external specifications and official documentation whose original text I checked on 2026-09-30. The source code of the adapter in nine versions of Next.js published on npm, and the responses to requests sent to the staging environment on the same day, are also among the sources.