{"record":{"id":"f669488814955627","repo":"grpc/grpc-go","slug":"extauthz-missing-default-value-in-deny-at-disable","errorCode":null,"errorMessage":"extauthz: missing default_value in deny_at_disable","messagePattern":"extauthz: missing default_value in deny_at_disable","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/ext_authz/ext_authz.go","lineNumber":118,"sourceCode":"\t}\n\n\tif msg.GetGrpcService() == nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: empty grpc_service provided in config %v\", cfg)\n\t}\n\tserver, err := parseGRPCServiceConfig(msg.GetGrpcService())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: failed to parse grpc_service: %v\", err)\n\t}\n\n\tfilterEnabled, err := parseFilterEnabled(msg.GetFilterEnabled())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar denyAtDisable bool\n\tif denyAtDisableFlag := msg.GetDenyAtDisable(); denyAtDisableFlag != nil {\n\t\tif denyAtDisableFlag.GetDefaultValue() == nil {\n\t\t\treturn nil, fmt.Errorf(\"extauthz: missing default_value in deny_at_disable\")\n\t\t}\n\t\tdenyAtDisable = denyAtDisableFlag.GetDefaultValue().GetValue()\n\t}\n\n\thttpStatus := int32(http.StatusForbidden)\n\tif st := msg.GetStatusOnError().GetCode(); st != 0 {\n\t\thttpStatus = int32(st)\n\t}\n\tstatusOnError := grpcStatusCode(httpStatus)\n\n\tmutationRules, err := httpfilter.HeaderMutationRulesFromProto(msg.GetDecoderHeaderMutationRules())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar allowedHeaders, disallowedHeaders []matcher.StringMatcher\n\tif allowed := msg.GetAllowedHeaders(); allowed != nil {\n\t\tallowedHeaders, err = httpfilter.ConvertStringMatchers(allowed.GetPatterns())","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/ext_authz/ext_authz.go#L100-L136","documentation":"Raised by ParseFilterConfig (ext_authz.go:118) when the config sets the deny_at_disable field (the message is non-nil) but its default_value sub-message is nil. deny_at_disable.default_value carries the actual boolean controlling whether traffic is denied when the filter is disabled; without it the behavior is ambiguous, so the resource is rejected.","triggerScenarios":"msg.GetDenyAtDisable() is non-nil at ext_authz.go:116, but denyAtDisableFlag.GetDefaultValue() returns nil at ext_authz.go:117 — i.e. a RuntimeFractionalPercent-shaped field was provided empty.","commonSituations":"A control-plane template renders deny_at_disable as an empty object '{ }' (e.g. a Helm value left blank) instead of '{ default_value: { value: true } }'; an incomplete programmatic config that sets the container but forgets the inner value.","solutions":["Either omit deny_at_disable entirely (the code at ext_authz.go:116 only validates when the field is present) or populate it fully.","When present, set deny_at_disable.default_value to a FractionalPercent/BoolValue carrying an explicit value, e.g. default_value: { value: true }.","Re-deploy the LDS resource and verify the client ACKs it."],"exampleFix":"// before\n//   ext_authz: { deny_at_disable: { } }   // default_value missing -> error 363\n//\n// after (option A: fully populate)\n//   ext_authz: { deny_at_disable: { default_value: { value: true } } }\n//\n// after (option B: omit it entirely)","handlingStrategy":"validation","validationCode":"// Mirror ext_authz.go:115-121: deny_at_disable, if set, must carry default_value.\nfunc validateDenyAtDisable(cfg *v3extauthzpb.ExtAuthz) error {\n    d := cfg.GetDenyAtDisable()\n    if d != nil && d.GetDefaultValue() == nil {\n        return fmt.Errorf(\"deny_at_disable set without default_value\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["If you do not need deny-on-disable semantics, omit deny_at_disable entirely rather than emitting an empty object.","When you set it, always populate default_value.value explicitly.","Lint control-plane templates for half-populated RuntimeFractionalPercent fields."],"tags":["grpc","xds","config","ext-authz"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}