{"record":{"id":"1b365db35807c461","repo":"nats-io/nats-server","slug":"failed-to-write-connect-request-v","errorCode":null,"errorMessage":"failed to write CONNECT request: %v","messagePattern":"failed to write CONNECT request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":655,"sourceCode":"\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to set deadline: %v\", err)\n\t}\n\n\treq := &http.Request{\n\t\tMethod: http.MethodConnect,\n\t\tURL:    &url.URL{Opaque: targetHost}, // Opaque is required for CONNECT\n\t\tHost:   targetHost,\n\t\tHeader: make(http.Header),\n\t}\n\n\t// Add proxy authentication if provided\n\tif username != \"\" && password != \"\" {\n\t\treq.Header.Set(\"Proxy-Authorization\", \"Basic \"+base64.StdEncoding.EncodeToString([]byte(username+\":\"+password)))\n\t}\n\n\tif err := req.Write(conn); err != nil {\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to write CONNECT request: %v\", err)\n\t}\n\n\tresp, err := http.ReadResponse(bufio.NewReader(conn), req)\n\tif err != nil {\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to read proxy response: %v\", err)\n\t}\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tresp.Body.Close()\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"proxy CONNECT failed: %s\", resp.Status)\n\t}\n\n\t// Close the response body\n\tresp.Body.Close()\n\n\t// Clear the deadline now that we've finished the proxy handshake","sourceCodeStart":637,"sourceCodeEnd":673,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L637-L673","documentation":"Writing the HTTP CONNECT request to the proxy connection failed. req.Write(conn) returned an error, meaning the socket was broken before/at the time the request was sent — the proxy accepted the TCP connection but the write could not complete.","triggerScenarios":"conn write error during establishHTTPProxyTunnel after successful dial: peer reset the connection, buffer full because proxy is unresponsive, network dropped mid-write, or deadline already expired before write.","commonSituations":"Proxy with very small read timeouts closing early; middleboxes (IPS/load balancers) rejecting CONNECT; network flaps in container environments; handshake deadline too tight for slow links.","solutions":["Increase the proxy timeout so the deadline does not expire before the write","Verify nothing between client and proxy strips or blocks HTTP CONNECT traffic","Retry — transient resets often succeed on a second attempt","Confirm the proxy actually speaks HTTP CONNECT on that port"],"exampleFix":"// before\nproxy {\n  url: \"http://proxy:3128\"\n  timeout: 1s\n}\n// after\nproxy {\n  url: \"http://proxy:3128\"\n  timeout: 15s\n}","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"_, err := establishHTTPProxyTunnel(purl, target, timeout, user, pass)\nif err != nil && strings.Contains(err.Error(), \"failed to write CONNECT request\") {\n    log.Warnf(\"CONNECT write failed, retrying: %v\", err)\n    time.Sleep(backoff)\n    // retry tunnel establishment\n}","preventionTips":["Increase proxy timeout to avoid deadline expiry mid-write","Confirm middleboxes between server and proxy permit CONNECT","Verify the proxy speaks HTTP CONNECT on the configured port","Check proxy stability/keepalive settings"],"tags":["network","proxy","write","connect"],"backgroundTag":"connection-reset","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}