{"record":{"id":"d7012130f526b2d8","repo":"netbirdio/netbird","slug":"forbidden","errorCode":null,"errorMessage":"Forbidden","messagePattern":"Forbidden","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"proxy/internal/auth/middleware.go","lineNumber":131,"sourceCode":"\n\t\tif !exists {\n\t\t\tnext.ServeHTTP(w, r)\n\t\t\treturn\n\t\t}\n\n\t\t// Set account and service IDs in captured data for access logging.\n\t\tsetCapturedIDs(r, config)\n\n\t\tif !mw.checkIPRestrictions(w, r, config) {\n\t\t\treturn\n\t\t}\n\n\t\t// Private services bypass operator schemes and gate on tunnel peer.\n\t\tif config.Private {\n\t\t\tif mw.forwardWithTunnelPeer(w, r, host, config, next) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\thttp.Error(w, \"Forbidden\", http.StatusForbidden)\n\t\t\treturn\n\t\t}\n\n\t\t// Domains with no authentication schemes pass through after IP checks.\n\t\tif len(config.Schemes) == 0 {\n\t\t\tnext.ServeHTTP(w, r)\n\t\t\treturn\n\t\t}\n\n\t\tif mw.handleOAuthCallbackError(w, r) {\n\t\t\treturn\n\t\t}\n\n\t\tif mw.forwardWithSessionCookie(w, r, host, config, next) {\n\t\t\treturn\n\t\t}\n\n\t\tif mw.forwardWithHeaderAuth(w, r, host, config, next) {","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/proxy/internal/auth/middleware.go#L113-L149","documentation":"Error \"Forbidden\" thrown in netbirdio/netbird.","triggerScenarios":"Thrown at proxy/internal/auth/middleware.go:131 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}