{"record":{"id":"66dfe9384556be7e","repo":"hasura/graphql-engine","slug":"the-authentication-hook-has-denied-to-execute-the","errorCode":null,"errorMessage":"The Authentication hook has denied to execute the request.","messagePattern":"The Authentication hook has denied to execute the request\\.","errorType":"http","errorClass":"Error","httpStatus":401,"severity":"error","filePath":"v3/crates/auth/hasura-authn-webhook/src/webhook.rs","lineNumber":29,"sourceCode":"use reqwest::{Url, header::ToStrError};\nuse serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as SerdeDeError};\n\nuse all_or_list::AllOrList;\nuse hasura_authn_core as auth_base;\nuse open_dds::{EnvironmentValue, session_variables};\nuse schemars::JsonSchema;\nuse tracing_util::{ErrorVisibility, SpanVisibility, TraceableError};\n\n#[derive(Debug, thiserror::Error)]\npub enum Error {\n    #[error(\n        \"Error in converting the header value corresponding to the {header_name} to a String - {error}\"\n    )]\n    ErrorInConvertingHeaderValueToString {\n        header_name: HeaderName,\n        error: ToStrError,\n    },\n    #[error(\"The Authentication hook has denied to execute the request.\")]\n    AuthenticationFailed { status: reqwest::StatusCode },\n    #[error(\"Internal Error - {0}\")]\n    Internal(#[from] InternalError),\n}\n\nimpl TraceableError for Error {\n    fn visibility(&self) -> ErrorVisibility {\n        // For the purpose of traces, all webhook errors should be developer facing.\n        ErrorVisibility::User\n    }\n}\n\n#[derive(Debug, thiserror::Error)]\npub enum InternalError {\n    #[error(\"Error while making the authentication HTTP request to the webhook - {0}\")]\n    ErrorWhileMakingHTTPRequestToTheAuthHook(reqwest::Error),\n    #[error(\n        \"The authentication hook has returned the status {0}. Only 200 and 401 response status are recognized.\"","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/auth/hasura-authn-webhook/src/webhook.rs#L11-L47","documentation":"The authentication webhook returned a non-success status, i.e. the auth hook explicitly denied the request. Execution stops before reaching the data layer.","triggerScenarios":"Your auth webhook endpoint returns 4xx (e.g. 401/403) for the forwarded request headers, so the engine refuses to execute the GraphQL request.","commonSituations":"Webhook rejects expired/invalid session tokens; webhook misconfigured to reject unknown headers; webhook endpoint down returning errors; test requests missing required auth headers.","solutions":["Check the webhook's decision logic and its logs for why it returned a denial status","Verify the request contains the headers the webhook expects","If the webhook itself errored (5xx from your handler), fix the handler bug","Confirm webhook URL and forwarding config in metadata"],"exampleFix":"// before: webhook returns 401 for all requests due to a bug\n// after: webhook validates Authorization header and returns 200 with roles, 401 only when truly unauthenticated","handlingStrategy":"fallback","validationCode":"// Pre-check webhook health\nconst ok = await fetch(webhookUrl, { method: 'HEAD' });","typeGuard":null,"tryCatchPattern":"On denial, return 401 to the client with a generic message; log the webhook's status/body internally for diagnosis.","preventionTips":["Keep webhook logic covered by tests","Distinguish webhook bugs (5xx) from genuine denials (401/403) in monitoring"],"tags":["webhook","auth","authorization"],"backgroundTag":"auth-webhook-denied","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}