{"record":{"id":"18c0e4d9351a5c61","repo":"cloudflare/cloudflared","slug":"failed-to-proxy-http-w","errorCode":null,"errorMessage":"Failed to proxy HTTP: %w","messagePattern":"Failed to proxy HTTP: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"connection/http2.go","lineNumber":134,"sourceCode":"\t}\n\n\tvar requestErr error\n\tswitch connType {\n\tcase TypeControlStream:\n\t\trequestErr = c.controlStreamHandler.ServeControlStream(r.Context(), respWriter, c.connOptions.ConnectionOptions(), c.orchestrator)\n\t\tif requestErr != nil {\n\t\t\tc.controlStreamErr = requestErr\n\t\t}\n\n\tcase TypeConfiguration:\n\t\trequestErr = c.handleConfigurationUpdate(respWriter, r)\n\n\tcase TypeWebsocket, TypeHTTP:\n\t\tstripWebsocketUpgradeHeader(r)\n\t\t// Check for tracing on request\n\t\ttr := tracing.NewTracedHTTPRequest(r, c.connIndex, c.log)\n\t\tif err := originProxy.ProxyHTTP(respWriter, tr, connType == TypeWebsocket); err != nil {\n\t\t\trequestErr = fmt.Errorf(\"Failed to proxy HTTP: %w\", err)\n\t\t}\n\n\tcase TypeTCP:\n\t\thost, err := getRequestHost(r)\n\t\tif err != nil {\n\t\t\trequestErr = fmt.Errorf(`cloudflared received a warp-routing request with an empty host value: %w`, err)\n\t\t\tbreak\n\t\t}\n\n\t\trws := NewHTTPResponseReadWriterAcker(respWriter, respWriter, r)\n\t\trequestErr = originProxy.ProxyTCP(r.Context(), rws, &TCPRequest{\n\t\t\tDest:      host,\n\t\t\tCFRay:     FindCfRayHeader(r),\n\t\t\tLBProbe:   IsLBProbeRequest(r),\n\t\t\tCfTraceID: r.Header.Get(tracing.TracerContextName),\n\t\t\tConnIndex: c.connIndex,\n\t\t})\n","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/connection/http2.go#L116-L152","documentation":"In the HTTP/2 origin connection's ServeHTTP, requests typed TypeWebsocket or TypeHTTP are handed to the origin proxy via ProxyHTTP. Any error from proxying (origin unreachable, bad URL in ingress rule, TLS failure, streaming error) is wrapped as `Failed to proxy HTTP: %w` and logged/returned to the edge. It is the generic umbrella error for HTTP/websocket proxying failures on an http2 connection.","triggerScenarios":"originProxy.ProxyHTTP returns an error while serving an incoming edge request with connection type TypeHTTP or TypeWebsocket — e.g. dialing the origin service fails, the ingress rule URL is malformed, or the origin resets the connection mid-request.","commonSituations":"Local origin service not running or listening on the wrong port, ingress `service:` URL typos (http:// vs https://), origin TLS certificate issues, or websocket upgrades rejected by the origin.","solutions":["Check the wrapped error text for the root cause and verify the origin service is running and reachable at the URL in the ingress rule","Verify `service:` in config.yml uses the correct scheme (http://, https://, or status: 200 for a hello-world)","Test the origin directly: `curl -I http://localhost:8080` from the same host","Inspect `cloudflared tunnel` logs for repeated failures; enable `--loglevel debug` for more detail"],"exampleFix":"# before (config.yml)\ningress:\n  - hostname: app.example.com\n    service: http:/localhost:8080\n# after\ningress:\n  - hostname: app.example.com\n    service: http://localhost:8080","handlingStrategy":"retry","validationCode":"// Verify origin reachability before starting the tunnel:\nresp, err := http.Get(\"http://localhost:8080/health\")\nif err != nil { log.Fatalf(\"origin unreachable: %v\", err) }\nresp.Body.Close()","typeGuard":null,"tryCatchPattern":"if strings.HasPrefix(err.Error(), \"Failed to proxy HTTP:\") {\n    // inspect wrapped cause with errors.Unwrap / %w chain, then retry or alert\n    log.Error().Err(err).Msg(\"origin proxy failure; check origin service and ingress service URL\")\n}","preventionTips":["Add health checks/monitoring on the origin service","Use correct scheme and port in ingress service URLs","Run curl against the origin from the tunnel host to pre-validate connectivity","Use `status: 200` hello-world service when testing without a real origin"],"tags":["http","proxy","origin","connection"],"backgroundTag":"http-request-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}