PBS Adapter: empty bidder array in eidpermissions causes s2s auction to fail

[derdeka]

Type of issue

Bug

Description

Prebid.js can send ext.prebid.data.eidpermissions entries with an empty bidders array to Prebid Server. This happens when an EID source is restricted to a bidder that is only configured client-side (not in the s2s config). Prebid Server validates that each eidpermissions entry has at least one bidder and rejects the entire request if it finds an empty array.

The server-side validation is at auction.go#L1020-L1022:

if len(bidders) == 0 {
    return []error{errors.New("request.ext.prebid.data.eidpermissions[].bidders[] required values but was empty")}
}

Root cause

In modules/prebidServerBidAdapter/bidderConfig.js, the replaceEids function filters eidpermissions bidders to only those present in requestedBidders (the s2s bidders). However, after filtering, entries that end up with an empty bidders array are not removed before being sent to PBS.

Reproduction scenario

1. Configure bidder-specific EIDs (e.g., EID source idC restricted to bidderA via ortb2Fragments.bidder)
2. bidderA is configured for Prebid.js only (client-side), not in the s2s config
3. bidderB is configured for s2s
4. The PBS adapter sends eidpermissions: [{ source: 'idC', bidders: [] }] to Prebid Server
5. Prebid Server rejects the request with: request.ext.prebid.data.eidpermissions[].bidders[] required values but was empty

Steps to reproduce

1. Set up a page with Prebid.js using both client-side and s2s bidders
2. Configure a bidder-specific EID (via setBidderConfig or ortb2Fragments.bidder) for a bidder that is not in the s2s config
3. Run an auction — the s2s request to PBS will be rejected

Test page

N/A — reproducible via unit tests.

Expected results

eidpermissions entries with empty bidders arrays should be filtered out before sending the request to Prebid Server. If no valid permissions remain, the eidpermissions field should be omitted entirely.

Actual results

eidpermissions includes entries like { source: 'idC', bidders: [] }, causing Prebid Server to reject the request.

Platform details

• Prebid.js: 11.3.0-pre (current master)
• Affected code: modules/prebidServerBidAdapter/bidderConfig.js (line 137-141)

Other information

• Related: #12594 — PBS Adapter: only include known bidders in eidpermissions — addressed the case of unknown bidder names in eidpermissions, but did not handle the case where filtering results in an empty bidders array.
• Related: #12571 — PBS Adapter: fix inconsistency in how bidderconfig is merged, with a special case for EIDs — introduced the eidpermissions logic.

Fix

After filtering permission.bidders to only requested (s2s) bidders, also remove any permission entries where bidders is empty:

consolidated.permissions = consolidated.permissions.filter(p => p.bidders.length > 0);