{"record":{"id":"8e0461ea50b145b9","repo":"dgraph-io/dgraph","slug":"dgraph-authorization-should-be-only-be-specified-o","errorCode":null,"errorMessage":"Dgraph.Authorization should be only be specified once in a schema, found second mention: %v","messagePattern":"Dgraph\\.Authorization should be only be specified once in a schema, found second mention: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"graphql/schema/schemagen.go","lineNumber":212,"sourceCode":"\treturn m.authMeta\n}\n\nfunc parseMetaInfo(sch string) (*metaInfo, error) {\n\tscanner := bufio.NewScanner(strings.NewReader(sch))\n\tauthSecret := \"\"\n\tschMetaInfo := &metaInfo{\n\t\tsecrets:            make(map[string]x.Sensitive),\n\t\tallowedCorsOrigins: make(map[string]bool),\n\t}\n\tvar err error\n\tfor scanner.Scan() {\n\t\ttext := strings.TrimSpace(scanner.Text())\n\n\t\tif strings.HasPrefix(text, \"#\") {\n\t\t\theader := strings.TrimSpace(text[1:])\n\t\t\tif strings.HasPrefix(header, \"Dgraph.Authorization\") {\n\t\t\t\tif authSecret != \"\" {\n\t\t\t\t\treturn nil, errors.Errorf(\"Dgraph.Authorization should be only be specified once in \"+\n\t\t\t\t\t\t\"a schema, found second mention: %v\", text)\n\t\t\t\t}\n\t\t\t\tauthSecret = text\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif strings.HasPrefix(header, \"Dgraph.Allow-Origin\") {\n\t\t\t\tparts := strings.Fields(text)\n\t\t\t\tif len(parts) != 3 {\n\t\t\t\t\treturn nil, errors.Errorf(\"incorrect format for specifying Dgraph.Allow-Origin\"+\n\t\t\t\t\t\t\" found for comment: `%s`, it should be `# Dgraph.\"+\n\t\t\t\t\t\t\"Allow-Origin \\\"http://example.com\\\"`\", text)\n\t\t\t\t}\n\t\t\t\tvar allowedOrigin string\n\t\t\t\tif err = json.Unmarshal([]byte(parts[2]), &allowedOrigin); err != nil {\n\t\t\t\t\treturn nil, errors.Errorf(\"incorrect format for specifying Dgraph.Allow-Origin\"+\n\t\t\t\t\t\t\" found for comment: `%s`, it should be `# Dgraph.\"+\n\t\t\t\t\t\t\"Allow-Origin \\\"http://example.com\\\"`\", text)","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/graphql/schema/schemagen.go#L194-L230","documentation":"parseMetaInfo scans schema comments for special headers (# Dgraph.Authorization, # Dgraph.Allow-Origin). Because only one authorization configuration is allowed per schema, a second `# Dgraph.Authorization` comment line causes this error, indicating ambiguous auth config.","triggerScenarios":"Calling NewHandler (or schema generation paths that invoke parseMetaInfo) with a schema string containing two or more comment lines starting with `# Dgraph.Authorization`.","commonSituations":"Concatenating multiple schema files that each carry their own Dgraph.Authorization header; copy-pasting the auth header into a schema that already had one; merging schemas from env + file.","solutions":["Remove all but one `# Dgraph.Authorization` comment from the schema, keeping the intended one.","If concatenating schema fragments, strip meta headers from all but the first fragment.","Centralize the auth header in a single schema source (e.g. the base schema file)."],"exampleFix":"// before\n# Dgraph.Authorization http://demo.io 100 group1\ntype User {...}\n# Dgraph.Authorization http://other.io 200 group2\n// after\n# Dgraph.Authorization http://demo.io 100 group1\ntype User {...}","handlingStrategy":"validation","validationCode":"// ensure only one Dgraph.Authorization header exists before submit\nvar count int\nfor _, line := range strings.Split(schemaText, \"\\n\") {\n    if strings.HasPrefix(strings.TrimSpace(line), \"# Dgraph.Authorization\") {\n        count++\n    }\n}\nif count > 1 {\n    return fmt.Errorf(\"found %d Dgraph.Authorization headers, expected 1\", count)\n}","typeGuard":null,"tryCatchPattern":"h, err := schema.NewHandler(...)\nif err != nil {\n    if strings.Contains(err.Error(), \"Dgraph.Authorization should be only be specified once\") {\n        return fmt.Errorf(\"auth header duplicated in schema: %w\", err)\n    }\n    return err\n}","preventionTips":["Keep the Dgraph.Authorization header in exactly one canonical schema file.","Strip meta headers from schema fragments before concatenation.","Lint schema files for duplicate `# Dgraph.` headers in CI.","Document that only one auth header is allowed."],"tags":["dgraph","graphql","schema","authorization"],"backgroundTag":"duplicate-schema-directive","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}