{"record":{"id":"8504f1f6f3cc2589","repo":"istio/istio","slug":"outputclaimtoheaders-header-and-claim-value-must-b","errorCode":null,"errorMessage":"outputClaimToHeaders header and claim value must be non-empty string","messagePattern":"outputClaimToHeaders header and claim value must be non-empty string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/config/validation/validation.go","lineNumber":1694,"sourceCode":"\tfor _, location := range rule.FromParams {\n\t\tif len(location) == 0 {\n\t\t\terrs = multierror.Append(errs, errors.New(\"location query must be non-empty string\"))\n\t\t}\n\t}\n\n\tfor _, location := range rule.FromCookies {\n\t\tif len(location) == 0 {\n\t\t\terrs = multierror.Append(errs, errors.New(\"cookie name must be non-empty string\"))\n\t\t}\n\t}\n\n\tfor _, claimAndHeaders := range rule.OutputClaimToHeaders {\n\t\tif claimAndHeaders == nil {\n\t\t\terrs = multierror.Append(errs, errors.New(\"outputClaimToHeaders must not be null\"))\n\t\t\tcontinue\n\t\t}\n\t\tif claimAndHeaders.Claim == \"\" || claimAndHeaders.Header == \"\" {\n\t\t\terrs = multierror.Append(errs, errors.New(\"outputClaimToHeaders header and claim value must be non-empty string\"))\n\t\t\tcontinue\n\t\t}\n\t\tif err := ValidateStrictHTTPHeaderName(claimAndHeaders.Header); err != nil {\n\t\t\terrs = multierror.Append(errs, err)\n\t\t}\n\t}\n\tif rule.Timeout != nil {\n\t\tif err := agent.ValidateDuration(rule.Timeout); err != nil {\n\t\t\terrs = multierror.Append(errs, err)\n\t\t}\n\t}\n\treturn errs\n}\n\n// ValidatePeerAuthentication checks that peer authentication spec is well-formed.\nvar ValidatePeerAuthentication = RegisterValidateFunc(\"ValidatePeerAuthentication\",\n\tfunc(cfg config.Config) (Warning, error) {\n\t\tin, ok := cfg.Spec.(*security_beta.PeerAuthentication)","sourceCodeStart":1676,"sourceCodeEnd":1712,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pkg/config/validation/validation.go#L1676-L1712","documentation":"Thrown by Istio config validation when an authorization policy rule's OutputClaimToHeaders entry has an empty Claim or Header field. OutputClaimToHeaders copies JWT claims into upstream request headers, so both the source claim name and the target header name must be non-empty strings. The check runs per entry after the null check and before ValidateStrictHTTPHeaderName.","triggerScenarios":"An AuthorizationPolicy rule with outputClaimToHeaders: [{ claim: \"\", header: \"x-foo\" }] or [{ claim: \"sub\", header: \"\" }], applied via kubectl apply, istioctl validate, or AdmissionWebhook.","commonSituations":"YAML typos or a missing field in the outputClaimToHeaders stanza; templating (Helm) that renders an empty claim name when a value is unset; copying from docs and dropping one key.","solutions":["Set both claim and header to non-empty strings in every outputClaimToHeaders entry","Check for trailing indentation errors that made claim/header land outside the map","If generating with Helm/Go, default or assert the values before rendering","Run istioctl validate before applying"],"exampleFix":"# before\nrules:\n  - to: [{ source: { requestPrincipals: [\"*\"] } }]\n    outputClaimToHeaders:\n      - header: \"x-user\"\n# after\nrules:\n  - to: [{ source: { requestPrincipals: [\"*\"] } }]\n    outputClaimToHeaders:\n      - claim: \"sub\"\n        header: \"x-user\"","handlingStrategy":"validation","validationCode":"func validateClaimToHeader(entries []ClaimHeader) error {\n\tfor _, e := range entries {\n\t\tif strings.TrimSpace(e.Claim) == \"\" || strings.TrimSpace(e.Header) == \"\" {\n\t\t\treturn fmt.Errorf(\"outputClaimToHeaders claim and header must be non-empty (got claim=%q header=%q)\", e.Claim, e.Header)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":"func isValidClaimHeader(e *ClaimHeader) bool {\n\treturn e != nil && e.Claim != \"\" && e.Header != \"\"\n}","tryCatchPattern":null,"preventionTips":["Add schema validation (kubeconform/cue) for authorization policies in CI that requires both claim and header","Make Helm values for claim/header required so templates fail at render time"],"tags":["istio","authorization-policy","jwt","config-validation"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}