Basic auth on Drupal 8 sometimes fails (uses Anonymous instead)

Question

I have a drupal 8 (8.7.6) installation. It runs on both a Ubuntu VM on Windows and also on iPage. I've written a simple custom module that implements a Content Entity.

I connect using JSON:API and basic_auth and it works for a while, then eventually stops working. Client doesn't seem to matter (both cURL and a custom app).

If I uninstall and re-install the custom module, then it seems to fail more often. After that, if I remove/re-add an admin account then I can connect with that account for a while.

Looking at the drupal logs, I see the failing calls come in as: "Anonymous (not verified)" rather than the supplied credentials.

Any ideas on how to debug this or pointers? Thanks.

Answer 1

I just had the same issue and it turned out to be because of the core flood protection. This can be fixed by truncating the flood table or by changing the user_limit value in the user.flood config to a higher number.