500 Internal Server Error: Exception in the access-control Plugin

Membrane API Gateway returns 500 Internal Server Error with a link to this page when the access-control plugin throws an exception that it does not turn into an error response itself. Membrane aborts the exchange and answers with a generic error.

The Error Response

The response contains the status 500, the problem type https://membrane-api.io/problems/internal and a link to this page. The type internal means that the failure happened inside the gateway, not because of a validation verdict. In production mode, the title is replaced with Internal Server Error.

The detail field says where the exception happened:

Aborting! Exception caused in access-control during /path REQUEST flow.

Aborting! Exception caused in access-control during /path REQUEST flow.

Common Causes

An Unexpected Runtime Error in access-control

The plugin met input or a runtime state it does not handle and threw an exception instead of answering with its own error response. Look at the exception message in the response (development mode) and in the log. If it points to neither your configuration nor the message content, it is most likely a bug in Membrane.

The Plugin Is Nested in a request, response or abort Block

If access-control runs inside a request, response or abort block, an exception there produces the same link. The detail then reads … during access-control flow. An exception inside abort replaces the error response of the exchange that was aborted before.

Not a Body Read Error

When the exception comes from a request or response body that could not be read, Membrane usually reports a separate error ending in reading-body. Inside request, response and abort blocks, body read failures show up here as well.

How to Fix It

1. Check the detail field for the flow (request or response) and the path of the failing call.
2. Search the Membrane log. Every occurrence is logged at warn level with the full stack trace.
3. Check the configuration of access-control and the message that was processed when the exception occurred.
4. If the exception does not point to your configuration or to the message, report it with the stack trace on GitHub Issues.

Details in Production Mode

With production mode on, Membrane hides the exception message and adds a log key instead: Internal details are hidden. See server log (key: …). Search the log for that key.

configuration:
  production: true

configuration:
  production: true

This does not apply to plugins nested in request, response or abort. For those, the exception message and the stack trace are sent to the client even in production mode, so fix or remove the failing plugin instead of relying on production mode to hide them.

Related Documentation

Configuration reference:

• accessControl

← All Membrane error messages