{"record":{"id":"f10a03bcc73d586f","repo":"hasura/graphql-engine","slug":"invalid-header-value-for-header-header-name-er","errorCode":null,"errorMessage":"Invalid header value for header {header_name}: {error}","messagePattern":"Invalid header value for header (.+?): (.+?)","errorType":"validation","errorClass":"BuildRequestError","httpStatus":null,"severity":"error","filePath":"v3/crates/plugins/pre-ndc-request-plugin/src/execute.rs","lineNumber":46,"sourceCode":"        plugin_name: String,\n        error: serde_json::Value,\n    },\n    #[error(\"User error from plugin {plugin_name}\")]\n    PluginUserError {\n        plugin_name: String,\n        error: serde_json::Value,\n    },\n}\n\n#[derive(Debug, thiserror::Error)]\npub enum BuildRequestError {\n    #[error(\"Invalid header name {header_name}: {error}\")]\n    InvalidHeaderName {\n        header_name: String,\n        #[source]\n        error: InvalidHeaderName,\n    },\n    #[error(\"Invalid header value for header {header_name}: {error}\")]\n    InvalidHeaderValue {\n        header_name: HeaderName,\n        #[source]\n        error: InvalidHeaderValue,\n    },\n    #[error(\"Failed to convert session: {0}\")]\n    SessionConversionError(String),\n    #[error(\"Failed to convert session variable '{variable_name}': {error}\")]\n    SessionVariableConversionError {\n        variable_name: SessionVariableName,\n        error: serde_json::Error,\n    },\n    #[error(\"Serialization error: {0}\")]\n    SerializationError(#[from] serde_json::Error),\n}\n\nimpl TraceableError for Error {\n    fn visibility(&self) -> ErrorVisibility {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/plugins/pre-ndc-request-plugin/src/execute.rs#L28-L64","documentation":"The engine could not convert a configured header's value into an http::HeaderValue while building the request to the pre-NDC-request plugin. Header values must be visible ASCII (32-127, plus tab) and reasonably short; the error names the header and carries the underlying InvalidHeaderValue. Binary or non-ASCII session data in a forwarded header is a common cause.","triggerScenarios":"Forwarding a session variable into a header where the value contains non-ASCII bytes (e.g. raw JWT bytes, UUIDs with BOM, unicode user names) and HeaderValue::from_str fails during request construction.","commonSituations":"Forwarding arbitrary user profile fields as headers; values pulled from session/JWT claims containing non-ASCII characters; header values exceeding server length limits.","solutions":["Sanitize or percent-encode the value before it is forwarded as a header","Confirm the session variable you forward is expected to be ASCII text (ids, not names)","Restrict forwarded session variables to a known-safe allowlist in config","If unicode must be passed, base64-encode it on the plugin side"],"exampleFix":"// before\nlet v = HeaderValue::from_str(&raw_unicode)?;\n// after\nlet v = HeaderValue::from_str(&percent_encode(raw_unicode.as_bytes(), NON_ALPHANUMERIC).to_string())?;","handlingStrategy":"validation","validationCode":"fn ascii_header_value(v: &str) -> bool {\n    v.len() < 8192 && v.bytes().all(|b| (32..=127).contains(&b) || b == b'\\t')\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Allowlist which session variables are forwarded as headers","Encode non-ASCII values before forwarding"],"tags":["rust","http-headers","configuration","encoding","plugin"],"backgroundTag":"invalid-http-header-value","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}