{"record":{"id":"07d3a91c38f95e43","repo":"grpc/grpc-go","slug":"gcpauthn-failed-to-unmarshal-filter-config-v","errorCode":null,"errorMessage":"gcpauthn: failed to unmarshal filter config: %v","messagePattern":"gcpauthn: failed to unmarshal filter config: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/gcp_authn/gcp_authn_filter.go","lineNumber":69,"sourceCode":"type builder struct{}\n\ntype config struct {\n\thttpfilter.FilterConfig\n\tcacheSize uint64\n}\n\nfunc (builder) TypeURLs() []string {\n\treturn []string{\"type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig\"}\n}\n\nfunc (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {\n\tm, ok := cfg.(*anypb.Any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"gcpauthn: invalid filter config type %T\", cfg)\n\t}\n\tmsg := &v3gcpauthnpb.GcpAuthnFilterConfig{}\n\tif err := m.UnmarshalTo(msg); err != nil {\n\t\treturn nil, fmt.Errorf(\"gcpauthn: failed to unmarshal filter config: %v\", err)\n\t}\n\n\tcacheSize := uint64(defaultCacheSize)\n\tif cacheSizeConfig := msg.GetCacheConfig().GetCacheSize(); cacheSizeConfig != nil {\n\t\tif cacheSize = cacheSizeConfig.GetValue(); cacheSize == 0 {\n\t\t\treturn nil, fmt.Errorf(\"gcpauthn: cache_config.cache_size must be greater than zero\")\n\t\t}\n\t}\n\n\treturn config{cacheSize: cacheSize}, nil\n}\n\n// ParseFilterConfigOverride parses the provided override configuration.\n//\n// Note that we don't support overrides for this filter configuration,\n// but still validate it as part of the normal resource validation.\nfunc (b builder) ParseFilterConfigOverride(cfg proto.Message) (httpfilter.FilterConfig, error) {\n\treturn b.ParseFilterConfig(cfg)","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/gcp_authn/gcp_authn_filter.go#L51-L87","documentation":"After confirming the config is an *anypb.Any, ParseFilterConfig unmarshals it into GcpAuthnFilterConfig (gcp_authn_filter.go:68). A failure here means the Any payload is malformed, has the wrong type URL, or is schema-incompatible.","triggerScenarios":"The Any does not deserialize as GcpAuthnFilterConfig: wrong type URL, corrupt/truncated bytes, or incompatible schema version.","commonSituations":"Control plane emits a gcp_authn config from a mismatched protobuf version; misconfigured type URL; corruption during xDS transport.","solutions":["Verify Any.TypeURL equals type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig.","Regenerate the config from a control plane whose protobuf definitions match the client's go-control-plane.","Inspect the failing payload size/bytes for truncation."],"exampleFix":"// before: wrong type URL or corrupt bytes\nanyMsg := &anypb.Any{TypeUrl: \"type.googleapis.com/wrong\", Value: bad}\n\n// after\nanyMsg, _ := anypb.New(&v3gcpauthnpb.GcpAuthnFilterConfig{HttpUri: &corev3.HttpUri{Uri: \"https://metadata.google.internal/...\", Cluster: \"metadata\"}})","handlingStrategy":"validation","validationCode":"if cfg.(*anypb.Any).TypeUrl != \"type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig\" {\n    return nil, errors.New(\"wrong type URL for gcp_authn config\")\n}","typeGuard":null,"tryCatchPattern":"fc, err := b.ParseFilterConfig(cfg)\nif err != nil {\n    return err\n}","preventionTips":["Pin control-plane and go-control-plane protobuf versions together.","Validate TypeURL before decoding.","Log payload size on failure to detect corruption."],"tags":["gcp-authn","grpc","xds","config","serialization","go"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}