{"record":{"id":"2200cd7141dc30fc","repo":"hasura/graphql-engine","slug":"header-value-0-is-not-a-valid-header-value-for","errorCode":null,"errorMessage":"Header value '{0}' is not a valid header value for header '{1}' in the auth config","messagePattern":"Header value '(.+?)' is not a valid header value for header '(.+?)' in the auth config","errorType":"error_code","errorClass":"Warning","httpStatus":null,"severity":"warning","filePath":"v3/crates/auth/hasura-authn/src/lib.rs","lineNumber":272,"sourceCode":"        .unwrap()\n    }\n}\n\n/// Warnings for the user raised during auth config generation\n/// These are things that don't break the build, but may do so in future\n#[derive(Debug, PartialEq, thiserror::Error)]\npub enum Warning {\n    #[error(\n        \"AuthConfig v1 is deprecated. `allowRoleEmulationBy` has been removed. Please consider upgrading to AuthConfig v4.\"\n    )]\n    PleaseUpgradeV1ToV4,\n    #[error(\"AuthConfig v2 is deprecated. Please consider upgrading to AuthConfig v4.\")]\n    PleaseUpgradeV2ToV4,\n    #[error(\"AuthConfig v3 is deprecated. Please consider upgrading to AuthConfig v4.\")]\n    PleaseUpgradeV3ToV4,\n    #[error(\"Header '{0}', used in the auth config, is not a valid header name\")]\n    InvalidHeaderName(String),\n    #[error(\"Header value '{0}' is not a valid header value for header '{1}' in the auth config\")]\n    InvalidHeaderValue(String, String),\n}\n\nimpl Warning {\n    pub fn should_be_an_error(&self, flags: &open_dds::flags::OpenDdFlags) -> bool {\n        match self {\n            Warning::InvalidHeaderName(_) | Warning::InvalidHeaderValue(_, _) => {\n                flags.contains(open_dds::flags::Flag::DisallowInvalidHeadersInAuthConfig)\n            }\n            _ => false,\n        }\n    }\n}\n\n#[derive(Debug, thiserror::Error, PartialEq)]\npub enum Error {\n    #[error(\"Invalid URL for auth webhook: {0}\")]\n    InvalidAuthWebhookUrl(String),","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/auth/hasura-authn/src/lib.rs#L254-L290","documentation":"A warning raised during auth config generation: the configured value for a named header is not a valid HTTP header value (control characters, invalid formatting). It can be promoted to an error via OpenDD flags.","triggerScenarios":"An auth config entry sets a header value containing characters that fail HTTP header-value validation (newlines, control bytes, malformed quoted strings).","commonSituations":"Injecting environment-expanded or templated strings with newlines/escape sequences into header values, or copying values from browser devtools with trailing whitespace/control characters.","solutions":["Sanitize the header value — strip newlines, control characters, and invalid escapes","Use static, well-formed values for headers in the auth config","Run config validation with strict flags enabled so bad header values are caught at build time, not runtime"],"exampleFix":"// before\nheaderValues: { \"X-Hasura-Secret\": \"abc\\ndef\" }\n// after\nheaderValues: { \"X-Hasura-Secret\": \"abcdef\" }","handlingStrategy":"validation","validationCode":"use http::HeaderValue;\nfor (name, value) in auth_config.header_values() {\n    HeaderValue::from_str(value)\n        .map_err(|_| format!(\"invalid header value for {name}\"))?;\n}","typeGuard":"fn isValidHeaderValue(v: &str) -> bool {\n    !v.is_empty() && v.bytes().all(|b| b == b'\\t' || (0x20..=0x7e).contains(&b) || b == b'\\x80') == false\n}","tryCatchPattern":null,"preventionTips":["Strip newlines/control characters from templated header values","Use plain ASCII literals where possible","Validate the full auth config with strict flags before deploy"],"tags":["auth","headers","config-validation","http"],"backgroundTag":"invalid-header-value","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}