{"record":{"id":"ab25a47b2f631a30","repo":"hasura/graphql-engine","slug":"invalid-header-value-for-header-header-name-er-ab25a4","errorCode":null,"errorMessage":"Invalid header value for header {header_name}: {error}","messagePattern":"Invalid header value for header (.+?): (.+?)","errorType":"validation","errorClass":"BuildRequestError","httpStatus":null,"severity":"error","filePath":"v3/crates/plugins/pre-ndc-response-plugin/src/execute.rs","lineNumber":46,"sourceCode":"        plugin_name: String,\n        error: serde_json::Value,\n    },\n    #[error(\"User error from plugin {plugin_name}\")]\n    PluginUserError {\n        plugin_name: String,\n        error: serde_json::Value,\n    },\n}\n\n#[derive(Debug, thiserror::Error)]\npub enum BuildRequestError {\n    #[error(\"Invalid header name {header_name}: {error}\")]\n    InvalidHeaderName {\n        header_name: String,\n        #[source]\n        error: InvalidHeaderName,\n    },\n    #[error(\"Invalid header value for header {header_name}: {error}\")]\n    InvalidHeaderValue {\n        header_name: HeaderName,\n        #[source]\n        error: InvalidHeaderValue,\n    },\n    #[error(\"Failed to convert session: {0}\")]\n    SessionConversionError(String),\n    #[error(\"Failed to convert session variable '{variable_name}': {error}\")]\n    SessionVariableConversionError {\n        variable_name: SessionVariableName,\n        error: serde_json::Error,\n    },\n    #[error(\"Serialization error: {0}\")]\n    SerializationError(#[from] serde_json::Error),\n}\n\nimpl TraceableError for Error {\n    fn visibility(&self) -> ErrorVisibility {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/plugins/pre-ndc-response-plugin/src/execute.rs#L28-L64","documentation":"A header value forwarded to the pre-NDC-response plugin failed conversion to http::HeaderValue. Values must be visible ASCII; the error names the header and includes the underlying InvalidHeaderValue cause. Typically caused by non-ASCII session data being injected into a forwarded header.","triggerScenarios":"Forwarding a session variable (user name, raw token bytes) into a header where the value contains non-ASCII or control characters, so HeaderValue::from_str fails in build_request.","commonSituations":"Usernames/display names with unicode; JWT claims containing binary data; values with trailing newlines from env vars.","solutions":["Encode the value (percent-encoding or base64) before forwarding","Forward only ASCII-safe identifiers in headers","Strip/trim values sourced from env vars","Add a test asserting all forwarded session variables are ASCII"],"exampleFix":"// before\nHeaderValue::from_str(user_display_name)?;\n// after\nHeaderValue::from_str(&urlencode(user_display_name))?;","handlingStrategy":"validation","validationCode":"fn ascii_header_value(v: &str) -> bool {\n    v.bytes().all(|b| (32..=127).contains(&b) || b == b'\\t')\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Forward only ASCII-safe identifiers in headers","Percent-encode or base64 anything user-supplied"],"tags":["rust","http-headers","encoding","configuration","plugin"],"backgroundTag":"invalid-http-header-value","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}