dgraph-io/dgraph · error

While processing query

Error message

While processing query

What it means

After the query executes, Dgraph extracts the namespace (ACL/multi-tenancy) from the request context via x.ExtractNamespace. If the context lacks valid namespace information, the whole result is returned with this wrapped error. It is a multi-tenancy context problem, not a data problem.

Source

Thrown at query/query.go:3060

	Metrics    map[string]uint64
}

// Process handles a query request.
func (req *Request) Process(ctx context.Context) (er ExecutionResult, err error) {
	err = req.ProcessQuery(ctx)
	if err != nil {
		return er, err
	}
	er.Subgraphs = req.Subgraphs
	// calculate metrics.
	metrics := make(map[string]uint64)
	for _, sg := range er.Subgraphs {
		calculateMetrics(sg, metrics)
	}
	er.Metrics = metrics
	namespace, err := x.ExtractNamespace(ctx)
	if err != nil {
		return er, errors.Wrapf(err, "While processing query")
	}
	schemaProcessingStart := time.Now()
	if req.DqlQuery.Schema != nil {
		preds := x.NamespaceAttrList(namespace, req.DqlQuery.Schema.Predicates)
		req.DqlQuery.Schema.Predicates = preds
		if er.SchemaNode, err = worker.GetSchemaOverNetwork(ctx, req.DqlQuery.Schema); err != nil {
			return er, errors.Wrapf(err, "while fetching schema")
		}
		typeNames := x.NamespaceAttrList(namespace, req.DqlQuery.Schema.Types)
		req.DqlQuery.Schema.Types = typeNames
		if er.Types, err = worker.GetTypes(ctx, req.DqlQuery.Schema); err != nil {
			return er, errors.Wrapf(err, "while fetching types")
		}
	}

	if !x.IsRootNsOperation(ctx) {
		// Filter the schema nodes for the given namespace.
		er.SchemaNode = filterSchemaNodeForNamespace(namespace, er.SchemaNode)

View on GitHub (pinned to 759e242be6)

Solutions

1. Attach a valid access token: send X-Dgraph-AccessToken header (HTTP) or the auth token in gRPC metadata
2. Log in via /login endpoint to obtain a JWT for the target namespace and refresh it before expiry
3. Verify the token includes the correct namespace claim for the queried tenant
4. Ensure proxies/gateways do not strip Dgraph auth headers/metadata

Example fix

// before
curl http://localhost:8080/query -XPOST -d '{ me(func: uid(0x1)) { name } }'
// after
curl http://localhost:8080/query -XPOST -H 'X-Dgraph-AccessToken: <jwt>' -d '{ me(func: uid(0x1)) { name } }'

// Ensure a token with namespace claim is available before querying
if accessToken == "" {
    return errors.New("X-Dgraph-AccessToken required for multi-namespace cluster")
}

resp, err := txn.Query(ctx, dql)
if err != nil && strings.Contains(err.Error(), "While processing query") {
    // refresh login token then retry once
    if rerr := refreshLogin(ctx); rerr != nil { return rerr }
    resp, err = txn.Query(ctx, dql)
}

When it happens

Trigger: Sending a query without proper authentication/JWT that carries the namespace claim (e.g. missing X-Dgraph-AccessToken or Guardian/namespace user token), or a context whose namespace metadata was stripped between client and server.

Common situations: Enterprise multi-tenancy deployments where the client forgot to set the access token header, tokens expired, or a proxy stripped the header; also requests routed through tooling not propagating gRPC metadata.

Related errors

• While upserting user with id %s
• While ordering and paginating
• While parsing namespace:
• map phase failed to parse namespace
• Map phase failed to parse namespace

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/e167c39befc60268. Report an issue: GitHub.