{"record":{"id":"8bf0486d9ccd6132","repo":"grpc/grpc-go","slug":"rbac-nil-config-provided","errorCode":null,"errorMessage":"rbac: nil config provided","messagePattern":"rbac: nil config provided","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/rbac/rbac.go","lineNumber":175,"sourceCode":"}\n\nfunc (builder) IsTerminal() bool {\n\treturn false\n}\n\nfunc (builder) BuildServerFilter() httpfilter.ServerFilter {\n\treturn serverFilter{}\n}\n\nvar _ httpfilter.ServerFilterBuilder = builder{}\n\ntype serverFilter struct{}\n\nfunc (serverFilter) Close() {}\n\nfunc (serverFilter) BuildServerInterceptor(cfg httpfilter.FilterConfig, override httpfilter.FilterConfig) (resolver.ServerInterceptor, error) {\n\tif cfg == nil {\n\t\treturn nil, fmt.Errorf(\"rbac: nil config provided\")\n\t}\n\n\tc, ok := cfg.(config)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"rbac: incorrect config type provided (%T): %v\", cfg, cfg)\n\t}\n\n\tif override != nil {\n\t\t// override completely replaces the listener configuration; but we\n\t\t// still validate the listener config type.\n\t\tc, ok = override.(config)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"rbac: incorrect override config type provided (%T): %v\", override, override)\n\t\t}\n\t}\n\n\t// RBAC HTTP Filter is a no op from one of these two cases:\n\t// \"If absent, no enforcing RBAC policy will be applied\" - RBAC","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/rbac/rbac.go#L157-L193","documentation":"BuildServerInterceptor requires the listener-level config to be non-nil. A nil cfg means ParseFilterConfig either did not run or its result was dropped before interceptor construction - normally a defensive guard, not a user-facing config error.","triggerScenarios":"The xDS server-filter construction path invokes BuildServerInterceptor with a nil cfg, e.g. when a listener references the RBAC filter but the config parse produced nothing and the wiring passed nil onward.","commonSituations":"Internal wiring bug; a listener resource that lists the RBAC filter without a corresponding successful ParseFilterConfig result.","solutions":["Ensure ParseFilterConfig ran successfully and produced a non-nil FilterConfig before BuildServerInterceptor is called.","Verify the listener resource carries the RBAC filter config and that the httpfilter registry routes it to the RBAC builder."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// In a custom filter wiring path, guard the interceptor build.\nfunc buildSafe(cfg httpfilter.FilterConfig, override httpfilter.FilterConfig) (resolver.ServerInterceptor, error) {\n\tif cfg == nil {\n\t\treturn nil, errors.New(\"refusing to build rbac interceptor from nil config\")\n\t}\n\treturn serverFilter.BuildServerInterceptor(cfg, override)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always run ParseFilterConfig to completion before BuildServerInterceptor.","Treat a nil listener config as a configuration error at the resolver layer."],"tags":["rbac","xds","grpc","internal-wiring"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}