v7.6.0 v1/login API returns 401, while v7.5.1 works

[fuminori-ido-m]

Description:

• Rocketchat v7.6.0 "v1/login" API returns 401 (unauthorized).
• The versions less than v7.6.0 (e.g. v7.5.1) work well.
• Client is Jenkins plugin rocketchatnotifier v1.5.2
• Another client app looks facing the same issue

Steps to reproduce:

1. POST v1/login with 'user' and 'password' parameters.

Expected behavior:

Rocketchat API returns 200.

Actual behavior:

Rocketchat API returns 401.

Server Setup Information:

• Version of Rocket.Chat Server: 7.6.0
• License Type:
• Number of Users: 1
• Operating System: Alpine Linux v3.2
• Deployment Method: docker (rocketchat/rocket.chat:7.6.0)
• Number of Running Instances: 1
• DB Replicaset Oplog: enabled
• NodeJS Version: v22.13.1
• MongoDB Version: 6.0

Client Setup Information

• Desktop App or Browser Version: n/a (API client accessing from Jenkins plugin rocketchatnotifier v1.5.2)
• Operating System: Debian 12(bookworm)

Additional context

n/a

Relevant logs:

• Server log (debug mode)

{"level":35,"time":"2025-05-25T19:04:02.904Z","pid":1,"hostname":"my-app-84b5b9499d-vwxsn","name":"API","method":"POST","url":"http://localhost/api/v1/login","userAgent":"unirest-java/1.3.11","length":"41","host":"my-app-service:3000","remoteIP":"10.244.0.45","status":401,"responseTime":3}

• client log

jenkins.plugins.rocketchatnotifier.rocket.errorhandling.RocketClientException: The username and password provided are incorrect.
at PluginClassLoader for rocketchatnotifier//jenkins.plugins.rocketchatnotifier.rocket.RocketChatBasicCallAuthentication.doAuthentication(RocketChatBasicCallAuthentication.java:59)
at PluginClassLoader for rocketchatnotifier//jenkins.plugins.rocketchatnotifier.rocket.RocketChatClientCallBuilder.buildCall(RocketChatClientCallBuilder.java:95)
at PluginClassLoader for rocketchatnotifier//jenkins.plugins.rocketchatnotifier.rocket.RocketChatClientCallBuilder.buildCall(RocketChatClientCallBuilder.java:85)
at PluginClassLoader for rocketchatnotifier//jenkins.plugins.rocketchatnotifier.rocket.RocketChatClientImpl.getChannels(RocketChatClientImpl.java:95)
at PluginClassLoader for rocketchatnotifier//jenkins.plugins.rocketchatnotifier.RocketClientImpl.(RocketClientImpl.java:30)
at PluginClassLoader for rocketchatnotifier//jenkins.plugins.rocketchatnotifier.RocketChatNotifier$DescriptorImpl.doTestConnection(RocketChatNotifier.java:630)

[reetp]

Always test on the latest versions.

Check this first.

https://github.com/RocketChat/Rocket.Chat/releases/tag/7.6.1

[koda-pub]

Always test on the latest versions.

Check this first.

https://github.com/RocketChat/Rocket.Chat/releases/tag/7.6.1

On 7.6.1 still same issue

[fuminori-ido-m]

v7.6.1 has the same issue. Following is the server log after I upgraded to v7.6.1 and try to access from Jenkins plugin:

{"level":35,"time":"2025-05-26T20:39:44.357Z","pid":1,"hostname":"my-app-84b5b9499d-4kkrw","name":"API","method":"POST","url":"http://localhost/api/v1/login","userAgent":"unirest-java/1.3.11","length":"41","host":"my-service:3000","remoteIP":"10.244.0.53","status":401,"responseTime":2}
{"level":35,"time":"2025-05-26T20:39:44.374Z","pid":1,"hostname":"my-app-84b5b9499d-4kkrw","name":"API","method":"GET","url":"http://localhost/api/v1/me","userId":"nakai_bot","userAgent":"unirest-java/1.3.11","host":"my-service:3000","remoteIP":"10.244.0.53","status":401,"responseTime":3}

[sampaiodiego]

can you please confirm that the following command works?

curl -X POST \
-H "Content-Type: application/json" \
-d '{"user": "SAME_USERNAME", "password": "SAME_PASSWORD"}' \
http://your.rocket.chat.url/api/v1/login

[koda-pub]

can you please confirm that the following command works?

curl -X POST
-H "Content-Type: application/json"
-d '{"user": "SAME_USERNAME", "password": "SAME_PASSWORD"}'
http://your.rocket.chat.url/api/v1/login

For me:

"status":"success

[sampaiodiego]

thanks @koda-pub .. I wonder then how the Jenkins plugin is trying to log in.. any idea on how to debug this further? we know the log in endpoint works, we just need to figure out why it is not working for that specific plugin

[koda-pub]

What I've noticed that all integrations based on webhook are working fine (which is quite obvious) like AWX or Gitea.
In my case Home Assistant integration fails - and that one requires only dedicated account on Rocket Chat Documentaion

And it seems here is the source for RocketChat integration.

I know it's someone else code - but just FYI ;)

[sampaiodiego]

I was able to pinpoint the issue here.. On version 7.6.0 the log in using regular form data (x-www-form-urlencoded ) is not working due to an unintended change.

The PR #36068 fixes it, so in 7.7.0 it will get to work. We're evaluating into shipping a patch release for 7.6.x including the fix.

Meanwhile I figured out Home Assistant is using a very old library for communicating with Rocket.Chat so I opened a PR updating it: home-assistant/core#145755 this will fix the issue for Home Assistant since it uses JSON payload to log in.

[fuminori-ido-m]

My response is a little bit late, but, yes, my curl worked fine on the other side the jenkins plugin didn't.

I'm very appreciate to hear that the PR fixes and 7.6.x will come soon.

Thank you very much!

[koda-pub]

And I can confirm that it's working again for me with HA (on latest tag).
Thank you @sampaiodiego

[fuminori-ido-m]

I have confirmed that 7.6.2 works with jenkins 'rocketchatnotifier' plugin. Thank you very much!