{"record":{"id":"f669488814955627","repo":"grpc/grpc-go","slug":"extauthz-missing-default-value-in-deny-at-disable","errorCode":null,"errorMessage":"extauthz: missing default_value in deny_at_disable","messagePattern":"extauthz: missing default_value in deny_at_disable","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/ext_authz/ext_authz.go","lineNumber":118,"sourceCode":"\t}\n\n\tif msg.GetGrpcService() == nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: empty grpc_service provided in config %v\", cfg)\n\t}\n\tserver, err := parseGRPCServiceConfig(msg.GetGrpcService())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: failed to parse grpc_service: %v\", err)\n\t}\n\n\tfilterEnabled, err := parseFilterEnabled(msg.GetFilterEnabled())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar denyAtDisable bool\n\tif denyAtDisableFlag := msg.GetDenyAtDisable(); denyAtDisableFlag != nil {\n\t\tif denyAtDisableFlag.GetDefaultValue() == nil {\n\t\t\treturn nil, fmt.Errorf(\"extauthz: missing default_value in deny_at_disable\")\n\t\t}\n\t\tdenyAtDisable = denyAtDisableFlag.GetDefaultValue().GetValue()\n\t}\n\n\thttpStatus := int32(http.StatusForbidden)\n\tif st := msg.GetStatusOnError().GetCode(); st != 0 {\n\t\thttpStatus = int32(st)\n\t}\n\tstatusOnError := grpcStatusCode(httpStatus)\n\n\tmutationRules, err := httpfilter.HeaderMutationRulesFromProto(msg.GetDecoderHeaderMutationRules())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar allowedHeaders, disallowedHeaders []matcher.StringMatcher\n\tif allowed := msg.GetAllowedHeaders(); allowed != nil {\n\t\tallowedHeaders, err = httpfilter.ConvertStringMatchers(allowed.GetPatterns())","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/grpc/grpc-go/blob/0c51461d27177d997e14c642fe18c11668fc09a3/internal/xds/httpfilter/ext_authz/ext_authz.go#L100-L136","documentation":"The deny_at_disable field of the ExtAuthz config is set but its default_value is missing (ext_authz.go:117-118). The default_value is a required BoolValue that determines whether requests are denied (true) or allowed (false) when the filter is disabled.","triggerScenarios":"msg.GetDenyAtDisable() returns a non-nil value but denyAtDisableFlag.GetDefaultValue() returns nil, meaning the RuntimeFeature wrapper exists but lacks the nested BoolValue default.","commonSituations":"xDS server configures deny_at_disable but omits the nested default_value; partial ExtAuthz config template; Envoy config translation that drops the default_value sub-field.","solutions":["Ensure the xDS server sets deny_at_disable.default_value to a boolean when deny_at_disable is configured","If deny_at_disable behavior is not needed, omit the entire deny_at_disable field — it defaults to false","Check the Envoy/xDS server filter configuration for incomplete deny_at_disable nesting"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate deny_at_disable has default_value when set.\nif dad := msg.GetDenyAtDisable(); dad != nil && dad.GetDefaultValue() == nil {\n    return fmt.Errorf(\"extauthz: deny_at_disable is set but missing required default_value\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When configuring deny_at_disable, always include default_value with a boolean","If deny_at_disable behavior is not needed, omit the field entirely","Validate ExtAuthz configs for complete nested field structures before deployment"],"tags":["ext-authz","xds","http-filter","configuration"],"backgroundTag":null,"analyzedSha":"0c51461d27177d997e14c642fe18c11668fc09a3","analyzedAt":"2026-08-11T14:49:15.055Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}