{"record":{"id":"a88b1c354c2bef29","repo":"apache/cassandra","slug":"you-do-not-have-access-from-this-ip-remoteaddres","errorCode":null,"errorMessage":"You do not have access from this IP ${remoteAddress.getHostString()}","messagePattern":"You do not have access from this IP (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":613,"sourceCode":"            // prevent all other modifications of replicated system keyspaces\n            throw new UnauthorizedException(String.format(\"Cannot %s %s\", perm, resource));\n        }\n    }\n\n    public void validateLogin()\n    {\n        if (user == null)\n        {\n            throw new UnauthorizedException(\"You have not logged in\");\n        }\n        else if (!user.hasLocalAccess())\n        {\n            throw new UnauthorizedException(String.format(\"You do not have access to this datacenter (%s)\", Datacenters.thisDatacenter()));\n        }\n        else\n        {\n            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))\n                throw new UnauthorizedException(\"You do not have access from this IP \" + remoteAddress.getHostString());\n        }\n    }\n\n    public void ensureNotAnonymous()\n    {\n        validateLogin();\n        if (user.isAnonymous())\n            throw new UnauthorizedException(\"You have to be logged in and not anonymous to perform this request\");\n    }\n\n    /**\n     * Checks if this user is an ordinary user (not a super or system user).\n     *\n     * @return {@code true} if this user is an ordinary user, {@code false} otherwise.\n     */\n    public boolean isOrdinaryUser()\n    {\n        return !isSystem() && !isSuper();","sourceCodeStart":595,"sourceCodeEnd":631,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L595-L631","documentation":"UnauthorizedException thrown by ClientState.validateLogin() when the user is authenticated and DC-allowed but the client's source IP is not among the IPs the user is permitted to connect from (AuthenticatedUser.hasAccessFromIp fails, e.g. due to IP-based access restrictions on the role).","triggerScenarios":"Connecting from a client IP not listed in the role's allowed networks (network-authorizer / role IP allowlist); running an application from a new host, container, or after NAT change so its IP no longer matches the configured allowlist.","commonSituations":"After moving workloads into containers/Kubernetes where pod IPs are dynamic; firewall/NAT changes altering the apparent client IP; provisioning a role with CIDR restrictions then deploying from an unplanned subnet.","solutions":["Update the role's allowed IP/CIDR list to include the client's source address (re-run the network access grant).","Login with a role that has no IP restrictions, or create a dedicated role for the new host.","Verify what source IP the node sees (getRemoteAddress / logs) — NAT may mask the original IP.","In dynamic environments (K8s), either broaden the allowlist to the pod network CIDR or pin egress IPs."],"exampleFix":"// before: role restricted to 10.0.1.0/24, client at 10.0.5.7\n// after: extend grant\nGRANT EXECUTE ON ALL QUERIES TO app_role WITH RESTRICTION; -- include 10.0.5.0/24 in role's network allowlist","handlingStrategy":"validation","validationCode":"InetAddress clientIp = InetAddress.getLocalHost(); // the egress IP as seen by the node\nif (!roleAllowedCidrs.contains(clientIp))\n    throw new IllegalStateException(\"Client IP \" + clientIp + \" not in role allowlist\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use broad CIDR grants for dynamic environments (containers, cloud autoscaling).","Pin egress IPs via NAT gateways for restricted roles.","Re-validate IP allowlists after network changes."],"tags":["authentication","ip-acl","authorization"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}