{"record":{"id":"0be97d28e84d62a7","repo":"cloudflare/cloudflared","slug":"jwks-endpoint-s-returned-status-d","errorCode":null,"errorMessage":"JWKS endpoint %s returned status %d","messagePattern":"JWKS endpoint (.+?) returned status (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/jwks.go","lineNumber":111,"sourceCode":"// fetchJWKS fetches the JWKS from the auth domain's certs endpoint over HTTPS.\nfunc fetchJWKS(authDomain url.URL) (*jose.JSONWebKeySet, error) {\n\tjwksURL := authDomain\n\tjwksURL.Path = accessCertPath\n\n\tclient := &http.Client{\n\t\tCheckRedirect: func(_ *http.Request, _ []*http.Request) error {\n\t\t\treturn http.ErrUseLastResponse\n\t\t},\n\t\tTimeout: time.Second * 10,\n\t}\n\tresp, err := client.Get(jwksURL.String()) // nolint: gosec\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"failed to fetch JWKS from %s\", jwksURL.String())\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"JWKS endpoint %s returned status %d\", jwksURL.String(), resp.StatusCode)\n\t}\n\n\tbody, err := io.ReadAll(io.LimitReader(resp.Body, maxJWKSResponseSize+1))\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to read JWKS response body\")\n\t}\n\tif len(body) > maxJWKSResponseSize {\n\t\treturn nil, fmt.Errorf(\"JWKS response body exceeds %d bytes\", maxJWKSResponseSize)\n\t}\n\n\tvar keySet jose.JSONWebKeySet\n\tif err := json.Unmarshal(body, &keySet); err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to parse JWKS\")\n\t}\n\treturn &keySet, nil\n}\n\n// jwksCachePath returns the on-disk path for cached JWKS for the given auth domain.","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/jwks.go#L93-L129","documentation":"HTTP-level failure in fetchJWKS: the auth domain's certs endpoint (JWKS) answered with a non-200 status. The access JWT used for `cloudflared tunnel token`/access flows cannot be verified because the signing keys were not retrieved — could be a redirect (redirects are intentionally not followed), server error, or wrong auth domain.","triggerScenarios":"Thrown at token/jwks.go:111 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the auth domain URL and that the /cdn-cgi/access/certs endpoint is reachable.","A 3xx status means redirects are blocked by design — verify the domain is not redirecting.","Retry later on 5xx; callers with caching will refresh via verifyMetadataWithRetry."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}