{"record":{"id":"0a7454935f5d82a1","repo":"grpc/grpc-java","slug":"key-is-absent-or-empty","errorCode":null,"errorMessage":"\"key\" is absent or empty","messagePattern":"\"key\" is absent or empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java","lineNumber":77,"sourceCode":"  private static Principal parseSource(Map<String, ?> source) {\n    List<String> principalsList = JsonUtil.getListOfStrings(source, \"principals\");\n    if (principalsList == null || principalsList.isEmpty()) {\n      return Principal.newBuilder().setAny(true).build();\n    }\n    Principal.Set.Builder principalsSet = Principal.Set.newBuilder();\n    for (String principal: principalsList) {           \n      principalsSet.addIds(\n          Principal.newBuilder().setAuthenticated(\n            Authenticated.newBuilder().setPrincipalName(\n              getStringMatcher(principal)).build()).build());\n    }\n    return Principal.newBuilder().setOrIds(principalsSet.build()).build();\n  }\n\n  private static Permission parseHeader(Map<String, ?> header) throws IllegalArgumentException {\n    String key = JsonUtil.getString(header, \"key\");\n    if (key == null || key.isEmpty()) {\n      throw new IllegalArgumentException(\"\\\"key\\\" is absent or empty\");\n    }\n    if (key.charAt(0) == ':'\n        || key.startsWith(\"grpc-\")\n        || UNSUPPORTED_HEADERS.contains(key.toLowerCase(Locale.ROOT))) {\n      throw new IllegalArgumentException(String.format(\"Unsupported \\\"key\\\" %s\", key));\n    }\n    List<String> valuesList = JsonUtil.getListOfStrings(header, \"values\");\n    if (valuesList == null || valuesList.isEmpty()) {\n      throw new IllegalArgumentException(\"\\\"values\\\" is absent or empty\");\n    }\n    Permission.Set.Builder orSet = Permission.Set.newBuilder();\n    for (String value: valuesList) {\n      orSet.addRules(\n          Permission.newBuilder().setHeader(\n            HeaderMatcher.newBuilder()\n            .setName(key)\n            .setStringMatch(getStringMatcher(value)).build()).build());     \n    }","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java#L59-L95","documentation":"AuthorizationPolicyTranslator.parseHeader validates each HTTP-header rule of an authorization policy loaded from JSON. If the rule object has no \"key\" field, or its value is null or the empty string, the policy cannot be translated into a gRPC permission and IllegalArgumentException is thrown. The error is part of strict policy validation at translation time.","triggerScenarios":"Loading an authorization policy JSON where a rule's headers entry is missing \"key\" or has \"key\": \"\" — e.g. {\"headers\": [{\"values\": [\"admin\"]}]}.","commonSituations":"Hand-edited or generated authorization policy files missing fields; YAML/JSON templates with unfilled placeholders; upgrading gRPC and policy files written for looser validators.","solutions":["Add a non-empty \"key\" to every entry in the rule's headers list","Validate the policy JSON against the authorization policy schema before loading","Remove rules that have no key rather than passing empty objects","Check for whitespace-only keys and trim/reject them"],"exampleFix":"// before\n{\"name\":\"allow-admin\",\"headers\":[{\"values\":[\"admin\"]}]}\n// after\n{\"name\":\"allow-admin\",\"headers\":[{\"key\":\"x-user-group\",\"values\":[\"admin\"]}]}","handlingStrategy":"validation","validationCode":"static void checkHeaderRule(Map<String, ?> rule) {\n  String key = JsonUtil.getString(rule, \"key\");\n  if (key == null || key.isEmpty()) throw new IllegalArgumentException(\"header rule missing \\\"key\\\"\");\n}","typeGuard":null,"tryCatchPattern":"try { AuthorizationPolicyTranslator.translate(policyJson, serverName); } catch (IllegalArgumentException e) { throw new PolicyValidationException(\"Invalid authorization policy: \" + e.getMessage(), e); }","preventionTips":["Validate policy JSON against the schema before loading","Require \"key\" in every headers entry","Reject whitespace-only keys","Lint policy files in CI"],"tags":["grpc","authz","json-policy","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}