diff -U2 -r /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd_client/TorrentsRPC.cpp /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd_client/TorrentsRPC.cpp
--- /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd_client/TorrentsRPC.cpp	2026-10-14 16:14:04.000000000 +0000
+++ /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd_client/TorrentsRPC.cpp	2026-10-14 15:55:08.000000000 +0000
@@ -849,11 +849,4 @@
 					if (tunnel)
 					{
-						auto [authRequired, authString] = m_Server.GetAuth ({path.data (), path.size ()});
-						if (authRequired && request[boost::beast::http::field::authorization] != authString)
-						{
-							SendUnauthorizedResponse ();
-							return;
-						}
-
 						static constexpr std::string_view appjson { "application/json" };
 						if (request[boost::beast::http::field::content_type].starts_with (appjson) || // starts with
@@ -917,5 +910,5 @@
 		m_Response.result (boost::beast::http::status::unauthorized);
 		m_Response.set (boost::beast::http::field::server, "i2pd torrents RPC");
-		m_Response.set (boost::beast::http::field::www_authenticate, "Basic realm=\"i2pd torrents RPC\"");
+		m_Response.set (boost::beast::http::field::www_authenticate, "Basic realm=\"Transmission\"");
 		m_Response.prepare_payload ();
 		boost::beast::http::async_write (m_Socket, m_Response,
@@ -972,4 +965,10 @@
 					if (isPathValid)
 					{
+						auto [authRequired, authString] = m_Server.GetAuth (tunnelPath);
+						if (authRequired && req[boost::beast::http::field::authorization] != authString)
+						{
+							SendUnauthorizedResponse ();
+							return;
+						}
 						subUrlPath++;
 						fileSubUrl = std::accumulate (subUrlPath, urlPath.end (), std::filesystem::path{}, std::divides{});