API calls with an incorrect apikey should return 401 Unauthorized

Describe the bug

Connecting to zaproxy with an api key that is incorrect returns an empty response.

The REST-ful way is to return a 40x HTTP response.
This sends a clearer message back to the user what the source of the error is.

401 Unauthorized - The API key is not specified or is wrong, Caller is un-authorized (or rather un-authenticated).
403 Forbidden - Caller is forbidden to request the specified resource (authenticated, but actually unauthorized (not allowed)).

In addition, when proxying into zaproxy, for instance in kubernetes, you can end up getting a 502 Bad Gateway, which can indicate wrongly that zaproxy is down.

Steps to reproduce the behavior

Start ZAP as a daemon with an API key

docker run \
  --rm \
  --name zaproxy-test \
  -u zap \
  -p 80:8080 \
  -i ghcr.io/zaproxy/zaproxy:latest \
    zap.sh \
    -silent \
    -daemon \
    -host 0.0.0.0 \
    -port 8080 \
    -config api.addrs.addr.name=.* \
    -config api.addrs.addr.regex=true \
    -config network.localServers.aliases.alias.name=zaproxy.local \
    -config api.key=CORRECT_KEY

Run queries

Incorrect apikey

curl -I --resolve zaproxy.local:80:127.0.0.1 \
  "http://zaproxy.local/JSON/network/view/getAliases/?apikey=WRONG_KEY"

Response:

curl: (52) Empty reply from server

Correct apikey

curl -I --resolve zaproxy.local:80:127.0.0.1 \
  "http://zaproxy.local/JSON/network/view/getAliases/?apikey=CORRECT_KEY" 2>&1 | grep ^HTTP

Response:

HTTP/1.1 200 OK

Expected behavior

Incorrect apikey

curl -I --resolve zaproxy.local:80:127.0.0.1 \
  "http://zaproxy.local/JSON/network/view/getAliases/?apikey=WRONG_KEY"

Response:

HTTP/1.1 401 Unauthorized
...

Correct apikey BUT an API I'm not authorized for.

curl -I --resolve zaproxy.local:80:127.0.0.1 \
  "http://zaproxy.local/JSON/someVery/restricted/secretApi/?apikey=CORRECT_KEY"

Response:

HTTP/1.1 403 Forbidden
...

Software versions

zaproxy:latest
zaproxy:2.14.0

Screenshots

See examples

Errors from the zap.log file

120461 [ZAP-IO-Server-1-1] WARN org.zaproxy.zap.extension.api.API - API key incorrect or not supplied: WRONG_KEY in request from 172.17.0.1

Additional context

No response

Would you like to help fix this issue?

• Yes

Start with the org.zaproxy.zap.extension.api.API entry point named in the log and reproduce the incorrect-key request with the provided curl command. Trace how incorrect and unauthorized API requests are handled, then verify that the incorrect key produces HTTP 401 while a restricted API with a valid key produces HTTP 403.