{"record":{"id":"77051878ae90d470","repo":"hasura/graphql-engine","slug":"invalid-header-value-0","errorCode":null,"errorMessage":"Invalid header value: {0}","messagePattern":"Invalid header value: (.+?)","errorType":"exception","errorClass":"ConnectionInitError","httpStatus":null,"severity":"error","filePath":"v3/crates/graphql/graphql-ws/src/protocol/init.rs","lineNumber":124,"sourceCode":"                        }\n                        ConnectionInitState::Initialized { .. } => {\n                            Err(ConnectionInitError::AlreadyInitialized)\n                        }\n                    }\n                })\n            },\n        )\n        .await\n}\n\n/// Error types that may occur during connection initialization.\n#[derive(Debug, thiserror::Error)]\npub enum ConnectionInitError {\n    #[error(\"Connection already initialized\")]\n    AlreadyInitialized,\n    #[error(\"Invalid header name: {0}\")]\n    InvalidHeaderName(#[from] http::header::InvalidHeaderName),\n    #[error(\"Invalid header value: {0}\")]\n    InvalidHeaderValue(#[from] http::header::InvalidHeaderValue),\n    #[error(\"AuthError: {0}\")]\n    Authn(#[from] AuthError),\n    #[error(\"SessionError: {0}\")]\n    Session(#[from] SessionError),\n}\n\nimpl tracing_util::TraceableError for ConnectionInitError {\n    fn visibility(&self) -> tracing_util::ErrorVisibility {\n        tracing_util::ErrorVisibility::User\n    }\n}\n\n/// Parses headers from a given map of strings into an `http::HeaderMap`.\n/// Returns a parsed header map or an error if the headers are invalid.\nfn parse_headers(map: HashMap<String, String>) -> Result<http::HeaderMap, ConnectionInitError> {\n    let mut headers = http::HeaderMap::new();\n    for (key, value) in map {","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/graphql/graphql-ws/src/protocol/init.rs#L106-L142","documentation":"This error is thrown when a `connection_init` payload carries a header value that fails HTTP header value validation (via `http::header::InvalidHeaderValue`). The graphql-ws protocol layer converts connection-init payload fields into HTTP headers for authentication, and any value containing invalid characters (e.g. control bytes) produces this error.","triggerScenarios":"Sending a `connection_init` WebSocket message whose payload parameters include a header string with characters illegal in an HTTP header value (e.g. a bearer token containing a newline, or binary/control characters). It is surfaced through `ConnectionInitError::InvalidHeaderValue` during connection initialization.","commonSituations":"Malformed or corrupt auth tokens pasted into the connection init payload; proxied clients that inject invalid characters into header-like parameters; tests with raw string tokens containing control characters.","solutions":["Inspect the connection_init payload parameters and locate the header value with illegal characters","Sanitize or re-encode the offending value (strip newlines/control bytes) before connecting","If the token is binary, base64-encode it instead of passing raw bytes","Wrap connection setup to log the offending header name/value for faster diagnosis"],"exampleFix":"// before\nws.send(JSON.stringify({type:'connection_init',payload:{headers:{Authorization:`Bearer ${rawToken}`}}}));\n// after\nconst safe = rawToken.replace(/[\\r\\n\\x00-\\x1f]/g,'');\nws.send(JSON.stringify({type:'connection_init',payload:{headers:{Authorization:`Bearer ${safe}`}}}));","handlingStrategy":"validation","validationCode":"function isValidHeaderValue(v){ return typeof v==='string' && !/[\\x00-\\x1f\\x7f]/.test(v); }","typeGuard":null,"tryCatchPattern":"catch (e) { if (String(e).includes('Invalid header value')) { /* sanitize payload and retry connect */ } }","preventionTips":["Validate all header-like payload values for control characters before connecting","Base64-encode binary tokens","Add a unit test asserting the connection_init payload is header-safe"],"tags":["graphql-ws","websocket","http-headers","authentication"],"backgroundTag":"invalid-http-header-value","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}