{"record":{"id":"2b608aa6b3ad6a23","repo":"golang/go","slug":"tls-server-sent-unrequested-session-ticket","errorCode":null,"errorMessage":"tls: server sent unrequested session ticket","messagePattern":"tls: server sent unrequested session ticket","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client.go","lineNumber":1032,"sourceCode":"\t}\n\n\tif err := transcriptMsg(serverFinished, &hs.finishedHash); err != nil {\n\t\treturn err\n\t}\n\n\tcopy(out, verify)\n\treturn nil\n}\n\nfunc (hs *clientHandshakeState) readSessionTicket() error {\n\tif !hs.serverHello.ticketSupported {\n\t\treturn nil\n\t}\n\tc := hs.c\n\n\tif !hs.hello.ticketSupported {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server sent unrequested session ticket\")\n\t}\n\n\tmsg, err := c.readHandshake(&hs.finishedHash)\n\tif err != nil {\n\t\treturn err\n\t}\n\tsessionTicketMsg, ok := msg.(*newSessionTicketMsg)\n\tif !ok {\n\t\tc.sendAlert(alertUnexpectedMessage)\n\t\treturn unexpectedMessageError(sessionTicketMsg, msg)\n\t}\n\n\ths.ticket = sessionTicketMsg.ticket\n\treturn nil\n}\n\nfunc (hs *clientHandshakeState) saveSessionTicket() error {\n\tif hs.ticket == nil {","sourceCodeStart":1014,"sourceCodeEnd":1050,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client.go#L1014-L1050","documentation":"Thrown during the TLS 1.2-or-earlier client handshake in readSessionTicket() when the server sends a NewSessionTicket message but the client did not include the SessionTicket extension in its ClientHello. RFC 5077 requires servers to only send session tickets to clients that advertised support via the SessionTicket extension.","triggerScenarios":"Triggered when hs.serverHello.ticketSupported is true (server supports tickets) AND hs.hello.ticketSupported is false (client omitted the SessionTicket extension). The client sends alertIllegalParameter and aborts the handshake.","commonSituations":"Connecting to a non-compliant TLS server that unconditionally sends NewSessionTicket regardless of client preference. Custom tls.Config with SessionTicketsDisabled=true but the server ignores the absence of the extension. Buggy or older server implementations that don't check the client's ticket support.","solutions":["If you control the client, remove config.SessionTicketsDisabled=true or set it to false (the default) so the client advertises ticket support.","If you control the server, fix it to only send NewSessionTicket when the client included the SessionTicket extension.","If neither side is under your control, report the bug to the server operator — this is a server-side protocol violation.","As a workaround, pin the client to TLS 1.3 which handles session resumption via NewSessionTicket messages unconditionally."],"exampleFix":"// before\nconfig := &tls.Config{\n    SessionTicketsDisabled: true,\n}\nconn, err := tls.Dial(\"tcp\", addr, config)\n\n// after — let the client advertise session ticket support\nconfig := &tls.Config{}\nconn, err := tls.Dial(\"tcp\", addr, config)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Session ticket errors are untyped strings — match by substring\nconn, err := tls.Dial(\"tcp\", addr, config)\nif err != nil {\n    if strings.Contains(err.Error(), \"server sent unrequested session ticket\") {\n        // Server bug: enable session tickets in config and retry,\n        // or report to server operator\n        config.SessionTicketsDisabled = false\n        conn, err = tls.Dial(\"tcp\", addr, config)\n    }\n    if err != nil {\n        log.Fatalf(\"TLS dial failed: %v\", err)\n    }\n}","preventionTips":["Leave SessionTicketsDisabled at its default (false) unless you have a specific reason to disable it.","Test against the target server with openssl s_client before deploying custom tls.Config.","For TLS 1.3, session tickets are always sent post-handshake regardless of this setting."],"tags":["tls","go","handshake","session-ticket","protocol-violation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}