grpc/grpc-go · error

extauthz: missing default_value in deny_at_disable

Error message

extauthz: missing default_value in deny_at_disable

What it means

The deny_at_disable field of the ExtAuthz config is set but its default_value is missing (ext_authz.go:117-118). The default_value is a required BoolValue that determines whether requests are denied (true) or allowed (false) when the filter is disabled.

Solutions

1. Ensure the xDS server sets deny_at_disable.default_value to a boolean when deny_at_disable is configured
2. If deny_at_disable behavior is not needed, omit the entire deny_at_disable field — it defaults to false
3. Check the Envoy/xDS server filter configuration for incomplete deny_at_disable nesting

// Validate deny_at_disable has default_value when set.
if dad := msg.GetDenyAtDisable(); dad != nil && dad.GetDefaultValue() == nil {
    return fmt.Errorf("extauthz: deny_at_disable is set but missing required default_value")
}

When it happens

Trigger: msg.GetDenyAtDisable() returns a non-nil value but denyAtDisableFlag.GetDefaultValue() returns nil, meaning the RuntimeFeature wrapper exists but lacks the nested BoolValue default.

Common situations: xDS server configures deny_at_disable but omits the nested default_value; partial ExtAuthz config template; Envoy config translation that drops the default_value sub-field.

Related errors

• extauthz: empty grpc_service provided in config
• extauthz: missing default_value in filter_enabled
• extauthz: error parsing config
• extauthz: error parsing override config
• extauthz: failed to parse grpc_service

AI-assisted analysis of grpc/grpc-go@0c51461d27 (2026-08-11). Data as JSON: /api/errors/f669488814955627. Report an issue: GitHub.

Appendix: source

Thrown at internal/xds/httpfilter/ext_authz/ext_authz.go:118

	}

	if msg.GetGrpcService() == nil {
		return nil, fmt.Errorf("extauthz: empty grpc_service provided in config %v", cfg)
	}
	server, err := parseGRPCServiceConfig(msg.GetGrpcService())
	if err != nil {
		return nil, fmt.Errorf("extauthz: failed to parse grpc_service: %v", err)
	}

	filterEnabled, err := parseFilterEnabled(msg.GetFilterEnabled())
	if err != nil {
		return nil, err
	}

	var denyAtDisable bool
	if denyAtDisableFlag := msg.GetDenyAtDisable(); denyAtDisableFlag != nil {
		if denyAtDisableFlag.GetDefaultValue() == nil {
			return nil, fmt.Errorf("extauthz: missing default_value in deny_at_disable")
		}
		denyAtDisable = denyAtDisableFlag.GetDefaultValue().GetValue()
	}

	httpStatus := int32(http.StatusForbidden)
	if st := msg.GetStatusOnError().GetCode(); st != 0 {
		httpStatus = int32(st)
	}
	statusOnError := grpcStatusCode(httpStatus)

	mutationRules, err := httpfilter.HeaderMutationRulesFromProto(msg.GetDecoderHeaderMutationRules())
	if err != nil {
		return nil, err
	}

	var allowedHeaders, disallowedHeaders []matcher.StringMatcher
	if allowed := msg.GetAllowedHeaders(); allowed != nil {
		allowedHeaders, err = httpfilter.ConvertStringMatchers(allowed.GetPatterns())

View on GitHub (pinned to 0c51461d27)