{"record":{"id":"50a65b405b47a694","repo":"tailscale/tailscale","slug":"debug-access-denied-to-permit-access-set-ts-allo","errorCode":null,"errorMessage":"debug access denied; to permit access, set TS_ALLOW_DEBUG_IP=%v","messagePattern":"debug access denied; to permit access, set TS_ALLOW_DEBUG_IP=(.+?)","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"tsweb/tsweb.go","lineNumber":178,"sourceCode":"\t\tif part == enc {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n\n// Protected wraps a provided debug handler, h, returning a Handler\n// that enforces AllowDebugAccess and returns forbidden replies for\n// unauthorized requests.\nfunc Protected(h http.Handler) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\tif !AllowDebugAccess(r) {\n\t\t\tmsg := \"debug access denied\"\n\t\t\tif DevMode {\n\t\t\t\tipStr, _, _ := net.SplitHostPort(r.RemoteAddr)\n\t\t\t\tmsg += fmt.Sprintf(\"; to permit access, set TS_ALLOW_DEBUG_IP=%v\", ipStr)\n\t\t\t}\n\t\t\thttp.Error(w, msg, http.StatusForbidden)\n\t\t\treturn\n\t\t}\n\t\th.ServeHTTP(w, r)\n\t})\n}\n\n// Port80Handler is the handler to be given to\n// autocert.Manager.HTTPHandler.  The inner handler is the mux\n// returned by NewMux containing registered /debug handlers.\ntype Port80Handler struct {\n\tMain http.Handler\n\t// FQDN is used to redirect incoming requests to https://<FQDN>.\n\t// If it is not set, the hostname is calculated from the incoming\n\t// request.\n\tFQDN string\n}\n\nfunc (h Port80Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/tsweb/tsweb.go#L160-L196","documentation":"tsweb.Protected rejected a wrapped debug handler request because AllowDebugAccess failed; in DevMode the message is augmented with the caller's IP and a hint to whitelist it via TS_ALLOW_DEBUG_IP. The remote address is not an authorized debug client.","triggerScenarios":"Thrown at tsweb/tsweb.go:178 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set TS_ALLOW_DEBUG_IP to include your client IP and retry."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}