{"record":{"id":"26eedc27fcc076af","repo":"nats-io/nats-server","slug":"error-decoding-state-for-s","errorCode":null,"errorMessage":"Error decoding state for %s","messagePattern":"Error decoding state for (.+?)","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"server/monitor.go","lineNumber":720,"sourceCode":"\treturn val, nil\n}\n\nfunc decodeState(w http.ResponseWriter, r *http.Request) (ConnState, error) {\n\tstr := r.URL.Query().Get(\"state\")\n\tif str == _EMPTY_ {\n\t\treturn ConnOpen, nil\n\t}\n\tswitch strings.ToLower(str) {\n\tcase \"open\":\n\t\treturn ConnOpen, nil\n\tcase \"closed\":\n\t\treturn ConnClosed, nil\n\tcase \"any\", \"all\":\n\t\treturn ConnAll, nil\n\t}\n\t// We do not understand intended state here.\n\tw.WriteHeader(http.StatusBadRequest)\n\terr := fmt.Errorf(\"Error decoding state for %s\", str)\n\tw.Write([]byte(err.Error()))\n\treturn 0, err\n}\n\nfunc decodeSubs(w http.ResponseWriter, r *http.Request) (subs bool, subsDet bool, err error) {\n\tsubsDet = strings.ToLower(r.URL.Query().Get(\"subs\")) == \"detail\"\n\tif !subsDet {\n\t\tsubs, err = decodeBool(w, r, \"subs\")\n\t}\n\treturn\n}\n\n// HandleConnz process HTTP requests for connection information.\nfunc (s *Server) HandleConnz(w http.ResponseWriter, r *http.Request) {\n\tsortOpt := SortOpt(r.URL.Query().Get(\"sort\"))\n\tauth, err := decodeBool(w, r, \"auth\")\n\tif err != nil {\n\t\treturn","sourceCodeStart":702,"sourceCodeEnd":738,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/monitor.go#L702-L738","documentation":"The monitor state decoder cannot map the requested state string to a known connection state (open/closed/any/all). It writes HTTP 400 and returns this error, so the connz/subsz monitoring request is aborted.","triggerScenarios":"Requesting a monitoring endpoint like /connz?state=banana with an unrecognized state value; decodeConnzState receives a str that matches none of open/closed/any/all.","commonSituations":"Typo in the state query parameter; a client sending a boolean or numeric state; proxy scripts forwarding arbitrary user input into monitoring URLs.","solutions":["Use one of the accepted values: state=open, state=closed, state=any (or all)","Omit the state parameter entirely to use the default","Validate/whitelist the state parameter in any client or proxy constructing monitoring URLs"],"exampleFix":"// before\nGET /connz?state=OPEN_CONNECTIONS\n// after\nGET /connz?state=open","handlingStrategy":"validation","validationCode":"var validStates = map[string]bool{\"open\": true, \"closed\": true, \"any\": true, \"all\": true}\nif !validStates[strings.ToLower(state)] {\n\treturn fmt.Errorf(\"state must be open|closed|any|all, got %q\", state)\n}","typeGuard":null,"tryCatchPattern":"resp, err := http.Get(monitorURL + \"/connz?state=\" + state)\nif err != nil || resp.StatusCode == http.StatusBadRequest {\n\treturn fmt.Errorf(\"monitoring request rejected (check state param): status=%d err=%v\", statusIf(resp), err)\n}","preventionTips":["Whitelist state values in any client generating monitoring URLs","Use the /connz endpoint constants open/closed/any/all verbatim","Log the full request URL when monitoring calls return 400"],"tags":["monitoring","http-400","invalid-query-param"],"backgroundTag":"invalid-query-parameter","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}