🔖 Release 0.27.1

docs/release-notes.md

@@ -1,4 +1,10 @@
-## Next release
+## Latest changes
+
+## 0.27.1
+
+* Fix `auto_error=False` handling in `HTTPBearer` security scheme. Do not `raise` when there's an incorrect `Authorization` header if `auto_error=False`. PR [#282](https://github.com/tiangolo/fastapi/pull/282).
+
+* Fix type declaration of `HTTPException`. PR [#279](https://github.com/tiangolo/fastapi/pull/279).
 
 ## 0.27.0
 

fastapi/__init__.py

@@ -1,6 +1,6 @@
 """FastAPI framework, high performance, easy to learn, fast to code, ready for production"""
 
-__version__ = "0.27.0"
+__version__ = "0.27.1"
 
 from starlette.background import BackgroundTasks
 

fastapi/exceptions.py

@@ -1,10 +1,12 @@
+from typing import Any
+
 from pydantic import ValidationError
 from starlette.exceptions import HTTPException as StarletteHTTPException
 
 
 class HTTPException(StarletteHTTPException):
     def __init__(
-        self, status_code: int, detail: str = None, headers: dict = None
+        self, status_code: int, detail: Any = None, headers: dict = None
     ) -> None:
         super().__init__(status_code=status_code, detail=detail)
         self.headers = headers

fastapi/security/http.py

@@ -112,10 +112,13 @@ class HTTPBearer(HTTPBase):
             else:
                 return None
         if scheme.lower() != "bearer":
-            raise HTTPException(
-                status_code=HTTP_403_FORBIDDEN,
-                detail="Invalid authentication credentials",
-            )
+            if self.auto_error:
+                raise HTTPException(
+                    status_code=HTTP_403_FORBIDDEN,
+                    detail="Invalid authentication credentials",
+                )
+            else:
+                return None
         return HTTPAuthorizationCredentials(scheme=scheme, credentials=credentials)
 
 

tests/test_security_http_bearer_optional.py

@@ -64,5 +64,5 @@ def test_security_http_bearer_no_credentials():
 
 def test_security_http_bearer_incorrect_scheme_credentials():
     response = client.get("/users/me", headers={"Authorization": "Basic notreally"})
-    assert response.status_code == 403
-    assert response.json() == {"detail": "Invalid authentication credentials"}
+    assert response.status_code == 200
+    assert response.json() == {"msg": "Create an account first"}