{"record":{"id":"42f9b55e428b8059","repo":"hasura/graphql-engine","slug":"error-while-preparing-the-response-0","errorCode":null,"errorMessage":"Error while preparing the response: {0}","messagePattern":"Error while preparing the response: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/crates/plugins/pre-response-plugin/src/execute/common.rs","lineNumber":31,"sourceCode":"use tracing_util::{ErrorVisibility, TraceableError};\n\n#[derive(Debug, thiserror::Error)]\npub enum Error {\n    #[error(\"Error while making the HTTP request to the pre-parse plugin {0} - {1}\")]\n    ErrorWhileMakingHTTPRequestToTheHook(String, reqwest::Error),\n    #[error(\"Error while building the request for the pre-parse plugin {0} - {1}\")]\n    BuildRequestError(String, String),\n    #[error(\"Reqwest error: {0}\")]\n    ReqwestError(reqwest::Error),\n    #[error(\"Error parsing the request: {0}\")]\n    PluginRequestParseError(serde_json::Error),\n    #[error(\"Error parsing the engine response: {0}\")]\n    EngineResponseParseError(serde_json::Error),\n    #[error(\"Unexpected status code: {0}\")]\n    UnexpectedStatusCode(u16),\n    #[error(\"Error serializing the modified response: {0}\")]\n    ResponseSerializationError(serde_json::Error),\n    #[error(\"Error while preparing the response: {0}\")]\n    ResponsePreparationError(axum::http::Error),\n}\n\nimpl TraceableError for Error {\n    fn visibility(&self) -> ErrorVisibility {\n        ErrorVisibility::Internal\n    }\n}\n\nimpl Error {\n    pub fn to_graphql_response(self) -> lang_graphql::http::Response {\n        let is_internal = match &self {\n            Error::ErrorWhileMakingHTTPRequestToTheHook(_, _)\n            | Error::UnexpectedStatusCode(_)\n            | Error::ResponseSerializationError(_)\n            | Error::ResponsePreparationError(_) => false,\n            Error::BuildRequestError(_, _)\n            | Error::ReqwestError(_)","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/plugins/pre-response-plugin/src/execute/common.rs#L13-L49","documentation":"The pre-response plugin failed while preparing the final HTTP response object (axum::http::Error) — typically an invalid header name/value or body construction failure when turning the mutated response into an axum response.","triggerScenarios":"The hook-supplied headers or status produce an invalid http::Response — e.g. a header name with spaces, an invalid status code number, or a non-UTF8 header value.","commonSituations":"Hook injecting custom headers from user input without validation; status code outside 100-599; CR/LF injection in header values.","solutions":["Validate/strip illegal characters from hook-provided header names and values before building the response.","Clamp the hook-supplied status to a valid 100-599 range.","Reject or sanitize CR/LF and control characters in all header data."],"exampleFix":"// before\nlet name = hook_header.name; // may contain spaces/CRLF\nlet val = HeaderValue::from_str(&hook_header.value)?;\n\n// after\nlet name = hook_header.name.trim().replace([' ', '\\r', '\\n'], \"-\");\nlet val = HeaderValue::from_str(&hook_header.value)?;","handlingStrategy":"validation","validationCode":"fn valid_header(name: &str, value: &str) -> bool {\n    http::HeaderName::from_str(name).is_ok() && http::HeaderValue::from_str(value).is_ok()\n}","typeGuard":null,"tryCatchPattern":"match build_response(modified) {\n    Ok(r) => r,\n    Err(Error::ResponsePreparationError(_)) => original_response(), // fall back to unmodified response\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Validate hook-supplied headers/status with http crate types before building the response.","Strip CR/LF and control characters from all hook-provided strings.","Restrict which headers hooks may set via an allowlist."],"tags":["http","headers","plugin","rust","axum"],"backgroundTag":"invalid-http-header","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}