{"record":{"id":"025dfe734d351711","repo":"cloudflare/cloudflared","slug":"unrecognized-service-s-t","errorCode":null,"errorMessage":"unrecognized service: %s, %t","messagePattern":"unrecognized service: (.+?), %t","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/proxy.go","lineNumber":139,"sourceCode":"\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tflusher, ok := w.(http.Flusher)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"response writer is not a flusher\")\n\t\t}\n\t\trws := connection.NewHTTPResponseReadWriterAcker(w, flusher, req)\n\t\tlogger := logger.With().Str(logFieldDestAddr, dest).Logger()\n\t\tif err := p.proxyStream(tr.ToTracedContext(), rws, dest, originProxy, &logger); err != nil {\n\t\t\tlogRequestError(&logger, err)\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\tcase ingress.HTTPLocalProxy:\n\t\tp.proxyLocalRequest(originProxy, w, req, isWebsocket)\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"unrecognized service: %s, %t\", rule.Service, originProxy)\n\t}\n}\n\n// ProxyTCP proxies to a TCP connection between the origin service and cloudflared.\nfunc (p *Proxy) ProxyTCP(\n\tctx context.Context,\n\tconn connection.ReadWriteAcker,\n\treq *connection.TCPRequest,\n) error {\n\tincrementTCPRequests()\n\tdefer decrementTCPConcurrentRequests()\n\n\tlogger := newTCPLogger(p.log, req)\n\n\t// Try to start a new flow\n\tif err := p.flowLimiter.Acquire(management.TCP.String()); err != nil {\n\t\tlogger.Warn().Msg(\"Too many concurrent flows being handled, rejecting tcp proxy\")\n\t\treturn errors.Wrap(err, \"failed to start tcp flow due to rate limiting\")","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/proxy/proxy.go#L121-L157","documentation":"Returned by Proxy.ProxyHTTP when the resolved ingress rule's service type does not match any service kind the proxy knows how to handle (httpstatuses, bastion, HTTPLocalProxy, etc.). It means the ingress rule's Service field parsed into a type ProxyHTTP cannot dispatch, and the error includes both the service string and whether an origin proxy was produced. This indicates a misconfiguration or an unhandled service type in the ingress rules.","triggerScenarios":"An ingress rule's service URL has a scheme cloudflared does not recognize or cannot resolve to an origin service (e.g. unsupported scheme, malformed service string that still parsed), so the type switch in ProxyHTTP falls into the default branch.","commonSituations":"Typos in the service scheme in config.yml (e.g. 'htp://' instead of 'http://', missing 'http_status:'); remote-config pushing a service type newer than the running cloudflared binary supports; tests exercising ProxyHTTP with a rule whose service was never validated by ingress parsing.","solutions":["Check the rule's service value in the error output and correct the scheme (http://, https://, http_status:, bastion, unix:, etc.)","Validate the full config before running: cloudflared tunnel ingress validate","Upgrade cloudflared if the service type comes from remote config newer than the binary","For tests, construct rules only via ingress.ParseIngress so invalid service types are rejected early"],"exampleFix":"// before (config.yml)\ningress:\n  - service: htp://localhost:8080\n// after\ningress:\n  - service: http://localhost:8080","handlingStrategy":"validation","validationCode":"// Validate ingress rules before running the tunnel\n// shell: cloudflared tunnel ingress validate\n// Go: parse rules through the supported parser\nrules, err := ingress.ParseIngress(rawConfig)\nif err != nil {\n    return fmt.Errorf(\"invalid ingress service: %w\", err)\n}\nfor _, r := range rules.Rules {\n    if !supportedServiceSchemes[strings.SplitN(r.Service, \":\", 2)[0]] {\n        return fmt.Errorf(\"unsupported service: %s\", r.Service)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := proxy.ProxyHTTP(ctx, w, r, rule, log)\nif err != nil && strings.Contains(err.Error(), \"unrecognized service\") {\n    log.Error().Str(\"service\", rule.Service.String()).Msg(\"ingress rule service type not supported; check scheme and cloudflared version\")\n    http.Error(w, \"misconfigured service\", http.StatusBadGateway)\n    return\n}","preventionTips":["Run `cloudflared tunnel ingress validate` before deploying config changes","Only use documented service schemes: http://, https://, http_status:, bastion, unix:, unix+tls:, ws://","Keep the binary version in sync with remote configuration that may introduce newer service types"],"tags":["go","proxy","ingress","config"],"backgroundTag":"invalid-config-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}