{"record":{"id":"d20dc14495b10066","repo":"juanfont/headscale","slug":"debug-access-denied","errorCode":null,"errorMessage":"debug access denied","messagePattern":"debug access denied","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"hscontrol/debug.go","lineNumber":49,"sourceCode":"\t\t\th.ServeHTTP(w, r)\n\n\t\t\treturn\n\t\t}\n\n\t\t// [tsweb.AllowDebugAccess] rejects X-Forwarded-For and non-TS IPs.\n\t\t// Additionally allow private/LAN addresses so operators can reach\n\t\t// debug endpoints from their local network without tailscaled.\n\t\tipStr, _, err := net.SplitHostPort(r.RemoteAddr)\n\t\tif err == nil {\n\t\t\tip, parseErr := netip.ParseAddr(ipStr)\n\t\t\tif parseErr == nil && ip.IsPrivate() {\n\t\t\t\th.ServeHTTP(w, r)\n\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\thttp.Error(w, \"debug access denied\", http.StatusForbidden)\n\t})\n}\n\n// writeJSON marshals v with indentation and writes it as a 200 JSON response.\nfunc writeJSON(w http.ResponseWriter, v any) {\n\tb, err := json.MarshalIndent(v, \"\", \"  \")\n\tif err != nil {\n\t\thttpError(w, err)\n\t\treturn\n\t}\n\n\tw.Header().Set(\"Content-Type\", \"application/json\")\n\tw.WriteHeader(http.StatusOK)\n\t_, _ = w.Write(b)\n}\n\n// writeDebug renders a debug endpoint as JSON or text/plain depending on the\n// request's Accept header. JSON is produced only when explicitly requested;","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/debug.go#L31-L67","documentation":"Error \"debug access denied\" thrown in juanfont/headscale.","triggerScenarios":"Thrown at hscontrol/debug.go:49 when the library encounters an invalid state.","commonSituations":"Access to a debug endpoint was denied. Debug endpoints require the requesting identity to be authorized; use the CLI or an authorized local caller.","solutions":["Inspect the wrapped error for the underlying cause and correct the failing condition (debug access denied); retry the operation after fixing the input, configuration, or environment."],"exampleFix":"Inspect the wrapped error for the underlying cause and correct the failing condition (debug access denied); retry the operation after fixing the input, configuration, or environment.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}