{"record":{"id":"c8fd58266450f267","repo":"grpc/grpc-java","slug":"httpconnectionmanager-contains-invalid-httpfilter","errorCode":null,"errorMessage":"HttpConnectionManager contains invalid HttpFilter: ${filterConfig.getErrorDetail()}","messagePattern":"HttpConnectionManager contains invalid HttpFilter: (.+?)","errorType":"exception","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":540,"sourceCode":"      io.envoyproxy.envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter\n          httpFilter = proto.getHttpFiltersList().get(i);\n      String filterName = httpFilter.getName();\n      if (!names.add(filterName)) {\n        throw new ResourceInvalidException(\n            \"HttpConnectionManager contains duplicate HttpFilter: \" + filterName);\n      }\n      StructOrError<Filter.FilterConfig> filterConfig =\n          parseHttpFilter(httpFilter, filterRegistry, isForClient, args);\n      if ((i == proto.getHttpFiltersCount() - 1)\n          && (filterConfig == null || !isTerminalFilter(filterConfig.getStruct()))) {\n        throw new ResourceInvalidException(\"The last HttpFilter must be a terminal filter: \"\n            + filterName);\n      }\n      if (filterConfig == null) {\n        continue;\n      }\n      if (filterConfig.getErrorDetail() != null) {\n        throw new ResourceInvalidException(\n            \"HttpConnectionManager contains invalid HttpFilter: \"\n                + filterConfig.getErrorDetail());\n      }\n      if ((i < proto.getHttpFiltersCount() - 1) && isTerminalFilter(filterConfig.getStruct())) {\n        throw new ResourceInvalidException(\"A terminal HttpFilter must be the last filter: \"\n            + filterName);\n      }\n      filterConfigs.add(new Filter.NamedFilterConfig(filterName, filterConfig.getStruct()));\n    }\n\n    // Parse inlined RouteConfiguration or RDS.\n    if (proto.hasRouteConfig()) {\n      List<VirtualHost> virtualHosts = extractVirtualHosts(\n          proto.getRouteConfig(), filterRegistry, args);\n      return io.grpc.xds.HttpConnectionManager.forVirtualHosts(\n          maxStreamDuration, virtualHosts, filterConfigs);\n    }\n    if (proto.hasRds()) {","sourceCodeStart":522,"sourceCodeEnd":558,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L522-L558","documentation":"One of the HttpFilter entries in the HttpConnectionManager failed to parse: parseHttpFilter returned a StructOrError carrying an error detail (unknown filter type, invalid typed_config, unsupported config). XdsListenerResource surfaces that error detail as a ResourceInvalidException prefixed with 'HttpConnectionManager contains invalid HttpFilter:'.","triggerScenarios":"During the http_filters loop in parseHttpConnectionManager, filterConfig.getErrorDetail() != null — i.e. the filter's typed_config references an unknown filter name, has a malformed Any/Struct config, or the filter's own config parser rejected the values.","commonSituations":"Filters the gRPC filter registry does not recognize (Envoy-only filters like http lua or ext_proc), typed_config @type URLs that don't match the registered filter, or config fields invalid for the specific filter version.","solutions":["Read the embedded errorDetail in the message to identify which filter and field failed, then fix that filter's typed_config.","Remove filters unsupported by gRPC xDS (keep only router and other registered gRPC filters); do Envoy-specific filtering at the Envoy proxy.","Verify the filter's @type URL and config schema against the gRPC version in use; upgrade the library if the filter should be supported."],"exampleFix":"// before: Envoy-only filter gRPC cannot parse\nhttp_filters:\n  - name: envoy.filters.http.lua\n    typed_config: { \"@type\": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua, ... }\n// after\nhttp_filters:\n  - name: envoy.filters.http.router\n    typed_config: { \"@type\": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router }","handlingStrategy":"try-catch","validationCode":"// pre-check each filter against the registry before submission\nfor (HttpFilter f : hcm.getHttpFiltersList()) {\n  if (!KNOWN_GRPC_HTTP_FILTERS.contains(f.getName()))\n    throw new IllegalArgumentException(\"filter not supported by grpc xds: \" + f.getName());\n}","typeGuard":null,"tryCatchPattern":"try { applyResource(listener) } catch (ResourceInvalidException e) { if (e.getMessage().startsWith(\"HttpConnectionManager contains invalid HttpFilter\")) { logDetail(e.getMessage()); dropUnparsableFiltersAndResubmit(); } }","preventionTips":["Restrict http_filters to filters registered with gRPC xDS (primarily the router filter)","Validate typed_config @type URLs and schemas against the gRPC version","Parse the errorDetail embedded in the message to pinpoint the failing filter quickly"],"tags":["grpc","xds","http","filter-config"],"backgroundTag":"invalid-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}