Error for missing header is sent when passing a bad API key

[typesense]

Error for missing header is sent when passing a bad API key

[jasonbosco]

@Scalahansolo Could you also post the contents of typeSenseSecret() (minus the actual api keys)

[Scalahansolo]

@jasonbosco per our email chain, I had my read key and admin key mixed up :(. Again, as mentioned in that thread, I think it would be good to update the message on a bad key to be more clear about the issue as opposed to just saying the header wasn't included.

[jasonbosco]

Phew! Glad it wasn't a deeper issue :)

The reason the error message is vague is because from a security perspective, we don't want to provide information about a key not existing vs it existing & not having the right permissions, for a potential malicious actor to use as a source of information.

[Scalahansolo]

@jasonbosco I definitely understand the vagueness from a security perspective. With that being said however, even a malicious user would be able to tell "I've definitely included that header". Something along the lines of "401 Unauthorized: Invalid API Key" would be much better.