go auth_error ai_generated partial

rpc 错误：code = PermissionDenied desc = 调用方无权访问该资源

rpc error: code = PermissionDenied desc = caller does not have permission to access resource

ID: go/grpc-permission-denied

其他格式: JSON · Markdown 中文 · English
80%修复率
84%置信度
0证据数
2024-11-19首次发现

版本兼容性

版本状态引入弃用备注
1.x active — — —

根因分析

已认证的调用方通过了身份验证，但未通过授权——该主体缺少访问该方法或资源所需的角色/作用域。通常令牌有效，但签发给了不同的受众或作用域。

English

The authenticated caller passed authentication but failed authorization — the principal lacks the required role/scope for the method or resource. Often the token is valid but issued for a different audience or scope.

generic

解决方案

  1. 85% 成功率 
    Log the principal and required scope to confirm the mismatch, and verify the token audience:

p, _ := peer.FromContext(ctx)
log.Printf("denied for peer=%v method=%s", p.Addr, method)
// decode JWT claims: check aud and scope
  2. 82% 成功率 
    Request the correct OAuth scope when minting the token and propagate it through the interceptor:

// ensure scope includes the API's required scope, e.g. "orders.write"
ts := config.TokenSource(ctx, &oauth2.Token{AccessToken: tok})
ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)

无效尝试

常见但无效的做法:

  1. 85% 失败

    Refreshing a valid token yields another valid token with the same scopes; authorization still fails.

  2. 95% 失败

    Authorization decisions are deterministic per principal; retrying never grants a missing permission.