{"record":{"id":"2379485e007a5f80","repo":"hyperledger/fabric","slug":"invalid-nonce-specified-in-the-header","errorCode":null,"errorMessage":"invalid nonce specified in the header","messagePattern":"invalid nonce specified in the header","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/validation/msgvalidation.go","lineNumber":75,"sourceCode":"\tif err != nil {\n\t\treturn errors.WithMessage(err, \"creator's signature over the proposal is not valid\")\n\t}\n\n\tputilsLogger.Debugf(\"exits successfully\")\n\n\treturn nil\n}\n\n// checks for a valid SignatureHeader\nfunc validateSignatureHeader(sHdr *common.SignatureHeader) error {\n\t// check for nil argument\n\tif sHdr == nil {\n\t\treturn errors.New(\"nil SignatureHeader provided\")\n\t}\n\n\t// ensure that there is a nonce\n\tif len(sHdr.Nonce) == 0 {\n\t\treturn errors.New(\"invalid nonce specified in the header\")\n\t}\n\n\t// ensure that there is a creator\n\tif len(sHdr.Creator) == 0 {\n\t\treturn errors.New(\"invalid creator specified in the header\")\n\t}\n\n\treturn nil\n}\n\n// checks for a valid ChannelHeader\nfunc validateChannelHeader(cHdr *common.ChannelHeader) error {\n\t// check for nil argument\n\tif cHdr == nil {\n\t\treturn errors.New(\"nil ChannelHeader provided\")\n\t}\n\n\t// validate the header type","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/validation/msgvalidation.go#L57-L93","documentation":"validateSignatureHeader requires a non-empty Nonce in the SignatureHeader. The nonce is essential for uniqueness/replay protection and for computing the TransactionID. An empty nonce is treated as an invalid, unusable signature header.","triggerScenarios":"Submitting an envelope whose SignatureHeader.Nonce is a zero-length byte slice — e.g. an SDK generating a zero-value nonce, reusing a struct literal without setting Nonce, or a test fixture with an empty header.","commonSituations":"Custom client code building envelopes manually; SDK misuse where the nonce generator was not invoked; replay/reuse of a serialized header with the nonce stripped; bad test fixtures.","solutions":["Generate a fresh random nonce (e.g. 24+ random bytes) for each transaction before signing","Verify the SDK's proposal/envelope builder sets Nonce — do not construct SignatureHeader literals without it","Reject envelopes with empty nonce client-side before submit to give a clearer error","Fix test fixtures to include a non-empty nonce"],"exampleFix":"// before\nshdr := &common.SignatureHeader{Creator: creatorBytes} // Nonce empty\n// after\nnonce := make([]byte, 24)\nif _, err := rand.Read(nonce); err != nil {\n    return err\n}\nshdr := &common.SignatureHeader{Creator: creatorBytes, Nonce: nonce}","handlingStrategy":"validation","validationCode":"func noncePresent(shdr *common.SignatureHeader) bool {\n    return shdr != nil && len(shdr.Nonce) > 0\n}","typeGuard":null,"tryCatchPattern":"if err != nil && err.Error() == \"invalid nonce specified in the header\" {\n    // regenerate nonce and rebuild the transaction client-side\n}","preventionTips":["Generate a cryptographically random nonce for every transaction","Never construct SignatureHeader literals without setting Nonce","Reject empty-nonce envelopes at the client boundary before signing"],"tags":["hyperledger-fabric","validation","nonce","signature-header"],"backgroundTag":"invalid-transaction-nonce","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}