{"record":{"id":"4625d64bc218fb5b","repo":"hasura/graphql-engine","slug":"error-in-parsing-the-header-name-header-err","errorCode":null,"errorMessage":"Error in parsing the {header_name} header: {err}","messagePattern":"Error in parsing the (.+?) header: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/crates/auth/hasura-authn-jwt/src/jwt.rs","lineNumber":56,"sourceCode":"    DisallowedRole,\n    #[error(\"Error while parsing the claims map entry: {claim_name} - {err}\")]\n    ParseClaimsMapEntryError {\n        claim_name: String,\n        err: serde_json::Error,\n    },\n    #[error(\"Expected string value for claim {claim_name}\")]\n    ClaimMustBeAString { claim_name: String },\n    #[error(\"Required claim {claim_name} not found\")]\n    RequiredClaimNotFound { claim_name: String },\n    #[error(\"JWT Authorization token source: Header name {header_name} not found.\")]\n    AuthorizationHeaderSourceNotFound { header_name: String },\n    #[error(\"JWT Authorization token source: Cookie header not found\")]\n    CookieNotFound,\n    #[error(\n        \"JWT Authorization token source: cookie name {cookie_name} not found in the Cookie header\"\n    )]\n    CookieNameNotFound { cookie_name: String },\n    #[error(\"Error in parsing the {header_name} header: {err}\")]\n    AuthorizationHeaderParseError { err: String, header_name: String },\n    #[error(\"Error in parsing the Cookie header value: {err}\")]\n    CookieParseError { err: cookie::ParseError },\n    #[error(\"Missing corresponding value for the cookie with cookie name: {cookie_name}\")]\n    MissingCookieValue { cookie_name: String },\n    #[error(\"JWT validation error: {0}\")]\n    JWTValidationError(jwt::errors::Error),\n    #[error(\"Internal Error - {0}\")]\n    Internal(#[from] InternalError),\n}\n\nimpl TraceableError for Error {\n    fn visibility(&self) -> ErrorVisibility {\n        // For the purpose of traces, all JWT errors should be developer facing.\n        ErrorVisibility::User\n    }\n}\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/auth/hasura-authn-jwt/src/jwt.rs#L38-L74","documentation":"The header named `{header_name}` could not be parsed as expected while extracting the JWT; the raw parse error is included. Typically this covers malformed Authorization headers, e.g. missing the `Bearer ` prefix or containing invalid characters.","triggerScenarios":"Header-based JWT extraction where the Authorization header is present but malformed: no Bearer scheme, stray whitespace, or a value that fails to convert to a string.","commonSituations":"Client sends the raw token without `Bearer `; custom auth scheme mismatch; proxies rewriting the Authorization header.","solutions":["Check {err} and {header_name} to see exactly what failed","Ensure the client sends `Authorization: Bearer <token>` (or the configured scheme)","Verify no proxy mutates or re-encodes the header"],"exampleFix":"// before\nAuthorization: eyJhbGciOi...\n// after\nAuthorization: Bearer eyJhbGciOi...","handlingStrategy":"validation","validationCode":"const h = req.headers.get('authorization') ?? '';\nif (!/^Bearer \\S+$/.test(h)) return unauthorized('malformed Authorization header');","typeGuard":"const isBearerHeader = (h: string | null): h is `Bearer ${string}` => !!h && /^Bearer \\S+$/.test(h);","tryCatchPattern":"Return 401 without retry; log the parse error to spot proxy interference.","preventionTips":["Always send 'Authorization: Bearer <token>'","Regression-test proxies that rewrite auth headers"],"tags":["jwt","http-headers","authorization","auth"],"backgroundTag":"malformed-authorization-header","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}