{"record":{"id":"6aa53fd0e38d7acf","repo":"linera-io/linera-protocol","slug":"unauthorizedapplication","errorCode":"UnauthorizedApplication","errorMessage":"ExecutionError::UnauthorizedApplication(app_id)","messagePattern":"ExecutionError::UnauthorizedApplication\\(app_id\\)","errorType":"exception","errorClass":"ExecutionError","httpStatus":null,"severity":"error","filePath":"linera-execution/src/runtime.rs","lineNumber":947,"sourceCode":"            read_size += key.len() + value.len();\n        }\n        this.resource_controller\n            .track_bytes_read(read_size as u64)?;\n        Ok(key_values)\n    }\n\n    fn perform_http_request(\n        &mut self,\n        request: http::Request,\n    ) -> Result<http::Response, ExecutionError> {\n        let mut this = self.inner();\n        let app_permissions = this\n            .execution_state_sender\n            .send_request(|callback| ExecutionRequest::GetApplicationPermissions { callback })?\n            .recv_response()?;\n\n        let app_id = this.current_application().id;\n        ensure!(\n            app_permissions.can_make_http_requests(&app_id),\n            ExecutionError::UnauthorizedApplication(app_id)\n        );\n\n        this.resource_controller.track_http_request()?;\n\n        this.execution_state_sender\n            .send_request(|callback| ExecutionRequest::PerformHttpRequest {\n                request,\n                http_responses_are_oracle_responses:\n                    Self::LIMIT_HTTP_RESPONSE_SIZE_TO_ORACLE_RESPONSE_SIZE,\n                callback,\n            })?\n            .recv_response()\n    }\n\n    fn assert_before(&mut self, timestamp: Timestamp) -> Result<(), ExecutionError> {\n        let this = self.inner();","sourceCodeStart":929,"sourceCodeEnd":965,"githubUrl":"https://github.com/linera-io/linera-protocol/blob/6c226ddcb332ef55118dc8d0aafbd093d5420899/linera-execution/src/runtime.rs#L929-L965","documentation":"Linera's execution runtime rejects an application's outbound HTTP request when the chain's ApplicationPermissions do not allow it. The chain stores an optional make_http_requests list: None means every application may make HTTP requests, Some(list) means only the listed application IDs. This check runs in the shared BaseRuntime::perform_http_request (runtime.rs:947), so it applies to both contract and service HTTP oracle calls, and failing it aborts the whole block, not just the call.","triggerScenarios":"Calling ContractRuntime::perform_http_request or the service runtime's HTTP API from an application whose ID is not in the chain's make_http_requests list. Typically after a SystemOperation::ChangeApplicationPermissions set an explicit list that omits the app, or after OpenChain created the chain with restrictive permissions (e.g. ApplicationPermissions configured for a different app).","commonSituations":"Deploying an HTTP-calling app on a chain created for another application; updating permissions to Some(vec![...]) and forgetting the new app; re-publishing bytecode so the app gets a new ApplicationId without re-granting permission; copying a genesis or chain config with a restrictive permission list into a test setup.","solutions":["Submit SystemOperation::ChangeApplicationPermissions from the chain owner, adding this application's ID to make_http_requests (or setting it to None to allow all apps on that chain).","If the chain was opened with restrictive permissions, open or re-create the chain with ApplicationPermissions that include the app in make_http_requests.","If you do not own the chain, ask its owner to update the permissions; the error cannot be bypassed from the application side.","If permissions cannot be changed, remove the HTTP call from the application and feed the data in via operations or blobs instead."],"exampleFix":"// before\nlet response = runtime.perform_http_request(request)?; // fails: UnauthorizedApplication\n\n// after (one-time setup by the chain owner, then the call succeeds)\n// chain.submit(SystemOperation::ChangeApplicationPermissions(\n//     ApplicationPermissions { make_http_requests: Some(vec![app_id]), ..Default::default() }))\nlet response = runtime.perform_http_request(request)?;","handlingStrategy":"validation","validationCode":"// Before running the app's block, check the chain's permissions (e.g. via the node client / GraphQL):\n// let perms = node.chain_info(chain_id).await?.application_permissions;\nlet allowed = perms.make_http_requests\n    .as_ref()\n    .map_or(true, |ids| ids.contains(&app_id));\nif !allowed {\n    // submit ChangeApplicationPermissions first, or abort with a clear config error\n}","typeGuard":null,"tryCatchPattern":"match result {\n    Err(ExecutionError::UnauthorizedApplication(app_id)) => {\n        // deterministic until permissions change: do NOT retry;\n        // report that app_id needs make_http_requests on this chain\n    }\n    other => other,\n}","preventionTips":["Keep ApplicationPermissions in config-as-code next to the app deployment and review them in CI.","Whenever bytecode republish changes the ApplicationId, re-grant make_http_requests for the new ID.","Test HTTP-calling apps on a chain whose permissions mirror production before deploying."],"tags":["linera","application-permissions","http-request","oracle","blockchain"],"backgroundTag":"http-request-permission-denied","analyzedSha":"6c226ddcb332ef55118dc8d0aafbd093d5420899","analyzedAt":"2026-08-22T22:49:09.787Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}