{"record":{"id":"2279bcc6a9c26d0a","repo":"hashicorp/terraform","slug":"connection-error-statuscode-d","errorCode":null,"errorMessage":"Connection Error: StatusCode: %d","messagePattern":"Connection Error: StatusCode: (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/communicator/ssh/http_proxy.go","lineNumber":111,"sourceCode":"\t// Writes the request in the form expected by an HTTP proxy.\n\terr = req.Write(c)\n\tif err != nil {\n\t\tc.Close()\n\t\treturn nil, err\n\t}\n\n\tres, err := http.ReadResponse(bufio.NewReader(c), req)\n\n\tif err != nil {\n\t\tc.Close()\n\t\treturn nil, err\n\t}\n\n\tres.Body.Close()\n\n\tif res.StatusCode != http.StatusOK {\n\t\tc.Close()\n\t\treturn nil, fmt.Errorf(\"Connection Error: StatusCode: %d\", res.StatusCode)\n\t}\n\n\treturn c, nil\n}\n\n// NewHttpProxyDialer generate Http Proxy Dialer\nfunc newHttpProxyDialer(u *url.URL, forward proxy.Dialer) (proxy.Dialer, error) {\n\tvar proxyUserName, proxyPassword string\n\tif u.User != nil {\n\t\tproxyUserName = u.User.Username()\n\t\tproxyPassword, _ = u.User.Password()\n\t}\n\n\tpd := &proxyDialer{\n\t\tproxy:   *newProxyInfo(u.Host, u.Scheme, proxyUserName, proxyPassword),\n\t\tforward: forward,\n\t}\n","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/communicator/ssh/http_proxy.go#L93-L129","documentation":"Raised in proxyDialer.Dial when the HTTP proxy returns a non-200 status code in response to the CONNECT request used to tunnel the SSH connection. The communicator issues an HTTP CONNECT to the proxy and expects 200 OK; any other status (407, 403, 502, etc.) produces this error with the raw status code.","triggerScenarios":"The proxy server rejected the CONNECT tunnel: 407 Proxy Authentication Required (missing/wrong credentials), 403 Forbidden (ACL policy), 502/503 (proxy cannot reach upstream), or the proxy does not allow CONNECT to the target host/port.","commonSituations":"proxy_user_name or proxy_user_password is wrong or missing (407), the proxy has an allowlist that excludes the target host (403), the proxy is overloaded or the upstream is down (502/503), or the proxy does not support tunneling to non-standard ports.","solutions":["Match the status code: 407 means add/fix proxy_user_name and proxy_user_password; 403 means the proxy ACL blocks the target; 502/503 means upstream/proxy issue.","Verify proxy credentials are correct and the proxy allows CONNECT to the target host and port.","Test the proxy manually: curl -v -x http://user:pass@proxy:port --proxytunnel target:22.","If using a corporate proxy, confirm the target host/port is in the proxy's allowed CONNECT list."],"exampleFix":"// before\nconnection {\n  proxy_host = var.proxy\n  proxy_port = 3128\n}\n\n// after\nconnection {\n  proxy_host         = var.proxy\n  proxy_port         = 3128\n  proxy_user_name    = var.proxy_user\n  proxy_user_password = var.proxy_pass\n}","handlingStrategy":"validation","validationCode":"// Validate proxy CONNECT returns 200 before the full terraform run\nfunc validateProxyConnect(proxyHost, proxyPort, proxyUser, proxyPass, targetAddr string) error {\n    proxyURL := fmt.Sprintf(\"http://%s:%s@%s:%d\", proxyUser, proxyPass, proxyHost, proxyPort)\n    u, _ := url.Parse(proxyURL)\n    dialer, err := proxy.FromURL(u, proxy.Direct)\n    if err != nil {\n        return err\n    }\n    conn, err := dialer.Dial(\"tcp\", targetAddr)\n    if err != nil {\n        return fmt.Errorf(\"proxy CONNECT failed: %w\", err)\n    }\n    conn.Close()\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Interpret HTTP proxy status codes to guide remediation\nif err := comm.Connect(o); err != nil {\n    if strings.Contains(err.Error(), \"Connection Error: StatusCode: 407\") {\n        return errors.New(\"proxy requires authentication — set proxy_user_name and proxy_user_password\")\n    }\n    if strings.Contains(err.Error(), \"Connection Error: StatusCode: 403\") {\n        return errors.New(\"proxy forbids CONNECT to this host — check proxy ACL\")\n    }\n    return err\n}","preventionTips":["Match the status code to the fix: 407 = auth, 403 = ACL, 502/503 = upstream issue.","Test proxy CONNECT with curl -v -x before running terraform.","Ensure proxy_user_name and proxy_user_password are set if the proxy requires auth."],"tags":["http-proxy","proxy","network","authentication","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}