{"record":{"id":"d6e942f5ab81806d","repo":"SigNoz/signoz","slug":"codeforbidden-d6e942","errorCode":"CodeForbidden","errorMessage":"saml: expired saml response","messagePattern":"saml: expired saml response","errorType":"error_code","errorClass":"errors.Error","httpStatus":403,"severity":"error","filePath":"ee/authn/callbackauthn/samlcallbackauthn/authn.go","lineNumber":96,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tassertionInfo, err := sp.RetrieveAssertionInfo(formValues.Get(\"SAMLResponse\"))\n\tif err != nil {\n\t\tif errors.As(err, &saml2.ErrVerification{}) {\n\t\t\treturn nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, err.Error())\n\t\t}\n\n\t\tif errors.As(err, &saml2.ErrMissingElement{}) {\n\t\t\treturn nil, errors.New(errors.TypeNotFound, errors.CodeNotFound, err.Error())\n\t\t}\n\n\t\treturn nil, err\n\t}\n\n\tif assertionInfo.WarningInfo.InvalidTime {\n\t\treturn nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, \"saml: expired saml response\")\n\t}\n\n\temail, err := valuer.NewEmail(assertionInfo.NameID)\n\tif err != nil {\n\t\treturn nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, \"saml: invalid email\").WithAdditional(\"The nameID assertion is used to retrieve the email address, please check your IDP configuration and try again.\")\n\t}\n\n\tname := \"\"\n\tif nameAttribute := samlConfig.AttributeMapping.Name; nameAttribute != \"\" {\n\t\tif val := assertionInfo.Values.Get(nameAttribute); val != \"\" {\n\t\t\tname = val\n\t\t}\n\t}\n\n\tvar groups []string\n\tif groupAttribute := samlConfig.AttributeMapping.Groups; groupAttribute != \"\" {\n\t\tgroups = assertionInfo.Values.GetAll(groupAttribute)\n\t}","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/ee/authn/callbackauthn/samlcallbackauthn/authn.go#L78-L114","documentation":"parseMetricsTime in SigNoz's parser.go accepts epoch nanoseconds (float seconds), epoch seconds, or an RFC3339(9) string; if none parse, it returns 'cannot parse %q to a valid timestamp'. It is the parameter parser for the time= field of instant and query_range metrics API requests.","triggerScenarios":"Calling /api/v1/query or /api/v1/query_range (or parseInstantQueryMetricsRequest/parseQueryRangeRequest) with a time value that is neither a plain float/integer epoch nor RFC3339Nano — e.g. '2024-01-01 00:00' (space instead of T), '1h-ago', an empty-derived default, or a locale-formatted date.","commonSituations":"Frontends sending moment.js date-fns formatted strings instead of ISO-8601 with 'T'; shell scripts passing relative durations expecting Prometheus syntax; timezone offsets written as '+05:30' with a space separator; migrations from the Prometheus API which allows more formats.","solutions":["Send time as RFC3339Nano (e.g. 2024-01-01T00:00:00Z) or as epoch seconds/nanoseconds","Validate the timestamp client-side with the same three strategies (ParseFloat, integer epoch, time.Parse(time.RFC3339Nano)) before issuing the request","If you need Prometheus-style relative times like '5m', compute and send the absolute epoch instead"],"exampleFix":"# before\ncurl '.../api/v1/query?time=2024-01-01 00:00:00'\n\n# after\ncurl '.../api/v1/query?time=2024-01-01T00:00:00Z'","handlingStrategy":"validation","validationCode":"func validMetricsTime(s string) bool {\n\tif _, err := strconv.ParseFloat(s, 64); err == nil { return true }\n\tif _, err := time.Parse(time.RFC3339Nano, s); err == nil { return true }\n\treturn false\n}\nif !validMetricsTime(timeStr) { /* fix before sending */ }","typeGuard":"null","tryCatchPattern":"// client side (Go)\nif _, err := time.Parse(time.RFC3339Nano, s); err != nil {\n\ts = time.Now().UTC().Format(time.RFC3339Nano)\n}","preventionTips":["Standardize on RFC3339 with 'T' separator or epoch seconds","Never send space-separated datetimes","Add client-side parsing tests mirroring the server's three strategies"],"tags":["signoz","metrics","api-params","timestamp","parser"],"backgroundTag":"invalid-timestamp-format","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}