{"record":{"id":"029f711ea62fff19","repo":"cloudflare/cloudflared","slug":"error-while-processing-middleware-handler-s","errorCode":null,"errorMessage":"error while processing middleware handler %s","messagePattern":"error while processing middleware handler (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/proxy.go","lineNumber":67,"sourceCode":"\tflowLimiter cfdflow.Limiter,\n\tlog *zerolog.Logger,\n) *Proxy {\n\tproxy := &Proxy{\n\t\tingressRules: ingressRules,\n\t\toriginDialer: originDialer,\n\t\ttags:         tags,\n\t\tflowLimiter:  flowLimiter,\n\t\tlog:          log,\n\t}\n\n\treturn proxy\n}\n\nfunc (p *Proxy) applyIngressMiddleware(rule *ingress.Rule, r *http.Request, w connection.ResponseWriter) (error, bool) {\n\tfor _, handler := range rule.Handlers {\n\t\tresult, err := handler.Handle(r.Context(), r)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, fmt.Sprintf(\"error while processing middleware handler %s\", handler.Name())), false\n\t\t}\n\n\t\tif result.ShouldFilterRequest {\n\t\t\t_ = w.WriteRespHeaders(result.StatusCode, nil)\n\t\t\treturn fmt.Errorf(\"request filtered by middleware handler (%s) due to: %s\", handler.Name(), result.Reason), true\n\t\t}\n\t}\n\treturn nil, true\n}\n\n// ProxyHTTP further depends on ingress rules to establish a connection with the origin service. This may be\n// a simple roundtrip or a tcp/websocket dial depending on ingres rule setup.\nfunc (p *Proxy) ProxyHTTP(\n\tw connection.ResponseWriter,\n\ttr *tracing.TracedHTTPRequest,\n\tisWebsocket bool,\n) error {\n\tincrementRequests()","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/proxy/proxy.go#L49-L85","documentation":"applyIngressMiddleware runs each middleware handler attached to the matched ingress rule (e.g. access, rate-limit handlers). If handler.Handle returns an error it is wrapped with the handler's name so the operator knows which middleware rejected the request. A bool also indicates the request should be filtered.","triggerScenarios":"ProxyHTTP matches an ingress rule whose Handlers list contains a middleware whose Handle call errors — e.g. Cloudflare Access token validation failing, or a custom handler returning an error for the request.","commonSituations":"Access-protected routes where the request's JWT/Access token is invalid or expired, misconfigured Access application binding, or a custom middleware failing on malformed requests.","solutions":["Note the handler name in the wrapped message and check that middleware's specific failure (the inner error).","For Access handlers, ensure the client presents a valid Cloudflare Access token (cf_access_token / authenticated session).","Verify the ingress rule's middleware configuration matches the Access application/audience tags.","If the middleware is not wanted, remove it from the rule's configuration."],"exampleFix":"// before (config.yml)\ningress:\n  - hostname: app.example.com\n    service: http://localhost:8080\n    originRequest: {}\n// after (keep Access, but ensure app is configured)\ningress:\n  - hostname: app.example.com\n    service: http://localhost:8080\n# ensure Access application + token validation is set up in the Cloudflare dashboard","handlingStrategy":"try-catch","validationCode":"// Verify Access middleware prerequisites before routing:\n// ensure the request carries an Access token when the rule has handlers\nfunc requiresAccess(handlers []string) bool {\n    for _, h := range handlers {\n        if strings.Contains(strings.ToLower(h), \"access\") {\n            return true\n        }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"if err, filtered := p.applyIngressMiddleware(rule, r, w); err != nil || filtered {\n    log.Warn().Err(err).Str(\"handler\", rule.Handlers[0].Name()).Msg(\"middleware rejected request\")\n    return\n}","preventionTips":["Match ingress middleware configuration with the Access application/aud (AUD) tags in the dashboard.","Ensure clients complete the Access login flow before hitting protected routes.","Check handler names in logs to isolate the failing middleware quickly."],"tags":["middleware","ingress","request-handling"],"backgroundTag":"http-error-response","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}