{"record":{"id":"03f11ea6cab4a497","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-03f11e","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/platform/ws/SafeModeLivenessAction.java","lineNumber":45,"sourceCode":"\npublic class SafeModeLivenessAction implements SystemWsAction {\n  private final LivenessActionSupport livenessActionSupport;\n  private final SystemPasscode systemPasscode;\n\n  public SafeModeLivenessAction(LivenessActionSupport livenessActionSupport, SystemPasscode systemPasscode) {\n    this.livenessActionSupport = livenessActionSupport;\n    this.systemPasscode = systemPasscode;\n  }\n\n  @Override\n  public void define(WebService.NewController controller) {\n    livenessActionSupport.define(controller, this);\n  }\n\n  @Override\n  public void handle(Request request, Response response) throws Exception {\n    if (!systemPasscode.isValid(request)) {\n      throw new ForbiddenException(\"Insufficient privileges\");\n    }\n\n    livenessActionSupport.checkliveness(response);\n  }\n}\n","sourceCodeStart":27,"sourceCodeEnd":51,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/platform/ws/SafeModeLivenessAction.java#L27-L51","documentation":"SafeModeLivenessAction serves api/safe_mode/liveness, used to report process liveness during safe mode. Like the other safe-mode endpoints it authenticates via the system passcode, not user sessions; a request without a valid sonar.web.systemPasscode value gets ForbiddenException 'Insufficient privileges'.","triggerScenarios":"Calling api/safe_mode/liveness without the X-Sonar-Passcode header / passcode parameter, or with an incorrect value while the node is starting up in safe mode.","commonSituations":"Orchestrator liveness probes (Kubernetes livenessProbe) configured before sonar.web.systemPasscode was set; probe secret desynchronized after passcode rotation in a Helm chart or sonar.properties.","solutions":["Configure sonar.web.systemPasscode on the server and include the matching X-Sonar-Passcode header in the liveness probe request.","Synchronize the secret used by the probe with the server property (same Kubernetes secret/env value) and redeploy the probe after rotation.","Verify the passcode is not empty and the probe hits the correct port/context path."],"exampleFix":"// before\nlivenessProbe: { httpGet: { path: '/api/safe_mode/liveness', port: 9000 } }\n// after\nlivenessProbe: { httpGet: { path: '/api/safe_mode/liveness', port: 9000 }, httpHeaders: [{ name: 'X-Sonar-Passcode', valueFrom: 'systemPasscode' }] }","handlingStrategy":"validation","validationCode":"const passcode = k8sSecret['sonar-system-passcode'];\nif (!passcode) throw new Error('liveness probe cannot start without system passcode');","typeGuard":null,"tryCatchPattern":"try {\n  await probe('/api/safe_mode/liveness', { 'X-Sonar-Passcode': passcode });\n} catch (e) {\n  if (e.status === 403) failProbe('invalid system passcode');\n  else throw e;\n}","preventionTips":["Configure liveness probes with the passcode header from the same secret used by sonar.properties.","Re-deploy probe configs whenever the system passcode rotates.","Verify the property is set on the server before enabling safe-mode probes."],"tags":["sonarqube","webapi","passcode","liveness"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}