{"record":{"id":"15b85c3a6fd72427","repo":"hasura/graphql-engine","slug":"error-in-converting-the-header-value-corresponding","errorCode":null,"errorMessage":"Error in converting the header value corresponding to the {header_name} to a String - {error}","messagePattern":"Error in converting the header value corresponding to the (.+?) to a String - (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/crates/auth/hasura-authn-webhook/src/webhook.rs","lineNumber":22,"sourceCode":"use std::time::Duration;\n\nuse auth_base::{\n    AuthenticateResponse, Identity, Role, RoleAuthorization, SessionVariableName,\n    SessionVariableValue,\n};\nuse axum::http::{HeaderMap, HeaderName, StatusCode};\nuse reqwest::{Url, header::ToStrError};\nuse serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as SerdeDeError};\n\nuse all_or_list::AllOrList;\nuse hasura_authn_core as auth_base;\nuse open_dds::{EnvironmentValue, session_variables};\nuse schemars::JsonSchema;\nuse tracing_util::{ErrorVisibility, SpanVisibility, TraceableError};\n\n#[derive(Debug, thiserror::Error)]\npub enum Error {\n    #[error(\n        \"Error in converting the header value corresponding to the {header_name} to a String - {error}\"\n    )]\n    ErrorInConvertingHeaderValueToString {\n        header_name: HeaderName,\n        error: ToStrError,\n    },\n    #[error(\"The Authentication hook has denied to execute the request.\")]\n    AuthenticationFailed { status: reqwest::StatusCode },\n    #[error(\"Internal Error - {0}\")]\n    Internal(#[from] InternalError),\n}\n\nimpl TraceableError for Error {\n    fn visibility(&self) -> ErrorVisibility {\n        // For the purpose of traces, all webhook errors should be developer facing.\n        ErrorVisibility::User\n    }\n}","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/auth/hasura-authn-webhook/src/webhook.rs#L4-L40","documentation":"In webhook-based authentication, a request header value failed to convert to a UTF-8 string (http::HeaderValue::to_str returns ToStrError for non-ASCII bytes). The header can't be forwarded to the auth webhook.","triggerScenarios":"The outgoing webhook request forwards incoming headers; any header containing non-ASCII/invalid UTF-8 bytes triggers this when converted with to_str().","commonSituations":"Clients sending binary or latin-1 encoded header values; middleware injecting non-UTF-8 headers; headers with raw bytes from upstream proxies.","solutions":["Identify the offending header via {header_name} and capture/forward it as bytes (to_bytes) instead of to_str","Ensure clients send only ASCII/UTF-8 header values","Sanitize or skip non-UTF-8 headers before forwarding to the webhook"],"exampleFix":"// before\nlet value = header_value.to_str()?;\n// after\nlet value = std::str::from_utf8(header_value.as_bytes()).map_err(|_| Error::ErrorInConvertingHeaderValueToString{..})?; // or use as_bytes() directly","handlingStrategy":"try-catch","validationCode":"const isAsciiHeader = (v: string) => /^[\\x00-\\x7F]*$/.test(v);","typeGuard":null,"tryCatchPattern":"Catch ToStrError and fall back to forwarding header bytes (HeaderValue::as_bytes) or skip the header.","preventionTips":["Restrict request headers to ASCII/UTF-8 at the gateway","Test with byte-header fuzz inputs"],"tags":["http-headers","webhook","auth","utf8"],"backgroundTag":"non-utf8-header-value","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}