{"record":{"id":"627b0d50dcdd45d8","repo":"hyperledger/fabric","slug":"access-denied-627b0d","errorCode":null,"errorMessage":"access denied","messagePattern":"access denied","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/consensus/smartbft/verifier.go","lineNumber":171,"sourceCode":"\t})\n}\n\n// VerifyRequest verifies raw request\nfunc (v *Verifier) VerifyRequest(rawRequest []byte) (types.RequestInfo, error) {\n\treturn v.verifyRequest(rawRequest, false)\n}\n\nfunc (v *Verifier) verifyRequest(rawRequest []byte, noConfigAllowed bool) (types.RequestInfo, error) {\n\treq, err := v.ReqInspector.unwrapReq(rawRequest)\n\tif err != nil {\n\t\treturn types.RequestInfo{}, err\n\t}\n\n\terr = v.AccessController.Evaluate([]*protoutil.SignedData{\n\t\t{Identity: req.sigHdr.Creator, Data: req.envelope.Payload, Signature: req.envelope.Signature},\n\t})\n\tif err != nil {\n\t\treturn types.RequestInfo{}, errors.Wrap(err, \"access denied\")\n\t}\n\n\tif noConfigAllowed && req.chHdr.Type != int32(cb.HeaderType_ENDORSER_TRANSACTION) {\n\t\treturn types.RequestInfo{}, errors.Errorf(\"only endorser transactions can be sent with other transactions\")\n\t}\n\n\tif req.chHdr.ChannelId != v.Channel {\n\t\treturn types.RequestInfo{}, errors.Errorf(\"request is for channel %s but expected channel %s\", req.chHdr.ChannelId, v.Channel)\n\t}\n\n\tswitch req.chHdr.Type {\n\tcase int32(cb.HeaderType_CONFIG):\n\tcase int32(cb.HeaderType_ORDERER_TRANSACTION):\n\t\treturn types.RequestInfo{}, fmt.Errorf(\"orderer transactions are not supported in v3\")\n\tcase int32(cb.HeaderType_ENDORSER_TRANSACTION):\n\tdefault:\n\t\treturn types.RequestInfo{}, errors.Errorf(\"transaction of type %s is not allowed to be included in blocks\", cb.HeaderType_name[req.chHdr.Type])\n\t}","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/consensus/smartbft/verifier.go#L153-L189","documentation":"verifyRequest evaluates the request's creator signature against the channel's AccessController policy. If the policy evaluation fails — the envelope signature does not verify or the creator is not authorized to submit on this channel — the error is wrapped as \"access denied\".","triggerScenarios":"Submitting an envelope with an invalid or missing signature; creator identity not a member/authorized principal of the channel; envelope bytes tampered with after endorsement.","commonSituations":"Client using an identity from another org/MSP not allowed on the channel; expired or revoked certificates; corrupted envelope during transport; wrong channel targeted by a client.","solutions":["Re-sign/resubmit the envelope with a valid identity of an authorized organization","Verify the client's MSP is included in the channel's ACL/policy for delivering transactions","Check certificate expiry and CRLs; re-enroll if the cert is expired or revoked","Ensure the envelope payload was not modified after signing (rebuild with the SDK)","Confirm the client targets the intended channel"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"sd := &protoutil.SignedData{Identity: creator, Data: payload, Signature: sig}\nif err := accessController.Evaluate([]*protoutil.SignedData{sd}); err != nil {\n    return fmt.Errorf(\"client not authorized: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := VerifyRequest(req); err != nil {\n    if strings.Contains(err.Error(), \"access denied\") {\n        // re-sign envelope with an authorized identity and resubmit\n    }\n}","preventionTips":["Use an identity whose org is a channel member","Check channel ACLs/writers policy before submitting","Re-enroll before certificates expire"],"tags":["hyperledger-fabric","access-control","signature","policy"],"backgroundTag":"access-denied","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}