{"record":{"id":"96a4acdfbb8294ba","repo":"gravitational/teleport","slug":"deny-body","errorCode":null,"errorMessage":"deny.body","messagePattern":"deny\\.body","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/srv/app/appresources.go","lineNumber":216,"sourceCode":"\tif len(decision.droppedRoles) > 0 && c.v9WarnOnce(\"drop\", identity.Username, app.GetName()) {\n\t\tlog.WarnContext(r.Context(), \"Dropped v8-or-older roles that grant a v9-governed app; v8 roles cannot re-open unrestricted access.\", \"dropped_roles\", decision.droppedRoles)\n\t}\n\n\tif decision.allowed {\n\t\treturn false, nil\n\t}\n\n\tif decision.versionSkew && c.v9WarnOnce(\"skew\", identity.Username, app.GetName()) {\n\t\tlog.WarnContext(r.Context(), \"Denied app request: the user's roles carry app_resources rules or role versions that this Teleport version does not implement, and unimplemented rules deny by default. Upgrade this app agent to enforce the intended rules.\")\n\t}\n\n\tif isCORSPreflight(r) && c.v9WarnOnce(\"cors\", identity.Username, app.GetName()) {\n\t\tlog.WarnContext(r.Context(), \"Denied CORS preflight: the app denies requests by default and no v9 rule allows OPTIONS.\")\n\t}\n\n\tdeny := newDenyResponse(decision)\n\tc.emitRequestDenied(r, &identity, app, deny.kind)\n\thttp.Error(w, deny.body, deny.status)\n\treturn true, nil\n}\n\n// isGovernedByAppResources reports whether v9 app_resources rules govern this\n// app type.\nfunc isGovernedByAppResources(app types.Application) bool {\n\treturn !app.IsAWSConsole() && !app.IsAzureCloud() && !app.IsGCP() && !app.IsLLM() &&\n\t\tapp.GetSubKind() != types.KindIdentityCenterAccount\n}\n\n// emitRequestDenied emits one audit event for a request denied under\n// fine-grained app access roles. The event is not rate limited.\nfunc (c *ConnectionsHandler) emitRequestDenied(r *http.Request, identity *tlsca.Identity, app types.Application, denyKind appresource.DenyKind) {\n\tevent := &apievents.AppSessionRequestDenied{\n\t\tMetadata: apievents.Metadata{\n\t\t\tType:        events.AppSessionRequestDeniedEvent,\n\t\t\tCode:        events.AppSessionRequestDeniedCode,\n\t\t\tClusterName: identity.RouteToApp.ClusterName,","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/app/appresources.go#L198-L234","documentation":"In enforceMinimalV9's deny path, this is the body text ('deny.body') written to the response when a v9-governed app request is denied — including the version-skew case where the user's roles carry app_resources rules or role versions this Teleport version does not implement, and unimplemented rules deny by default.","triggerScenarios":"Thrown at lib/srv/app/appresources.go:216 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Upgrade Teleport to a version that implements the v9 app_resources rules in the user's roles","Adjust the user's roles to remove unsupported v9 rules","Consult the app access v9 upgrade documentation for role migration"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}