elsa-workflows/elsa-core · error · HubException

Access denied.

Error message

Access denied.

What it means

The ElsaConsoleLogsHub checks authorization before streaming, subscribing, or updating filters via an injected authorizer (CanReadAsync). If the caller's connection context is not authorized to read console logs, a HubException("Access denied.") is thrown.

Solutions

1. Authenticate the SignalR connection (valid token/cookie) before invoking hub methods
2. Grant the connecting user/role the permission required to read console logs
3. If machine-to-machine, configure the authorizer/policy to allow the service identity
4. Verify hub authorization middleware (e.g. [Authorize] and access-token negotiation) is configured correctly

Example fix

// before
var conn = new HubConnectionBuilder().WithUrl("https://host/elsa-console-logs").Build(); // no token
// after
var conn = new HubConnectionBuilder()
    .WithUrl("https://host/elsa-console-logs", o => o.AccessToken = token)
    .Build();

// client: ensure an access token is available before connecting
if (string.IsNullOrEmpty(accessToken)) throw new InvalidOperationException("Console logs hub requires authentication.");

try { await connection.InvokeAsync("StreamAsync", filter); }
catch (HubException ex) when (ex.Message == "Access denied.")
{ logger.LogWarning("Not authorized for console logs; check credentials/permissions"); }

When it happens

Trigger: Connecting to the console logs SignalR hub without an authenticated user, without the required permission/policy, or with credentials that the authorizer's policy rejects.

Common situations: Calling the hub from a service/background job with no user attached; missing API token or cookie; user lacks the console-logs read permission; anonymous access not enabled in the host.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access denied.
• Access denied.
• ' ' is not a well-formed permission. Expected ' : '.
• Cannot overwrite an AI conversation that belongs to another…
• Cannot overwrite an AI conversation that belongs to another…

AI-assisted analysis of elsa-workflows/elsa-core@fe9217bdfa (2026-09-13). Data as JSON: /api/errors/abcf60cf6bbcdbc2. Report an issue: GitHub.

Appendix: source

Thrown at src/modules/Elsa.Diagnostics.ConsoleLogs/RealTime/ElsaConsoleLogsHub.cs:77

    {
        await UnsubscribeAsync().ConfigureAwait(false);
        await base.OnDisconnectedAsync(exception).ConfigureAwait(false);
    }

    private static ElsaConsoleLogFilter ValidateFilter(ElsaConsoleLogFilter? filter)
    {
        filter ??= new();

        if (filter.From is { } from && filter.To is { } to && from > to)
            throw new HubException("The console log filter 'from' timestamp must be earlier than or equal to 'to'.");

        return filter;
    }

    private async ValueTask EnsureCanReadAsync(CancellationToken cancellationToken)
    {
        if (!await authorizer.CanReadAsync(Context, cancellationToken).ConfigureAwait(false))
            throw new HubException("Access denied.");
    }
}

public interface IElsaConsoleLogsClient
{
    Task ReceiveConsoleLogLineAsync(ConsoleLogLine line, CancellationToken cancellationToken = default);
    Task ReceiveDroppedLinesAsync(ConsoleLogDroppedSummary summary, CancellationToken cancellationToken = default);
    Task ReceiveSourceChangedAsync(ConsoleLogSource source, CancellationToken cancellationToken = default);
}

View on GitHub (pinned to fe9217bdfa)