{"record":{"id":"3bda0dffff35fa5c","repo":"OpenNHP/opennhp","slug":"unexpected-status-code-d","errorCode":null,"errorMessage":"unexpected status code: %d","messagePattern":"unexpected status code: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/wasm/engine/host.go","lineNumber":48,"sourceCode":"\tbuf, ok := m.Memory().Read(offset, byteCount)\n\tif !ok {\n\t\tlog.Panicf(\"Memory.Read(%d, %d) out of range\", offset, byteCount)\n\t}\n\tfmt.Println(string(buf))\n}\n\nfunc GetEvidenceWithCCUrl() ([]byte, error) {\n\tclient := &http.Client{Timeout: 3 * time.Second}\n\n\tresp, err := client.Get(confidentialContainerEvidenceUrl)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"http request failed: %w\", err)\n\t}\n\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"unexpected status code: %d\", resp.StatusCode)\n\t}\n\n\tbody, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read response body: %w\", err)\n\t}\n\n\tvar buf bytes.Buffer\n\tw := zlib.NewWriter(&buf)\n\t_, err = w.Write(body)\n\tw.Close()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to compress response body: %w\", err)\n\t}\n\n\tcompressedBody := buf.Bytes()\n\n\treturn compressedBody, nil","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/wasm/engine/host.go#L30-L66","documentation":"Raised by GetEvidenceWithCCUrl in the WASM host functions: the HTTP GET to the confidential-container evidence URL returned a status other than 200 within the 3-second client timeout. The evidence endpoint (CC agent) is unreachable, erroring, or fronted by something returning an error page.","triggerScenarios":"The AAA on 127.0.0.1:8006 returns 4xx/5xx — e.g. 400 for a bad runtime_data parameter, 404 when the evidence route is missing, 500 when the underlying TEE hardware report cannot be fetched.","commonSituations":"AAA version that doesn't support the /aa/evidence endpoint shape or the runtime_data query parameter; TEE device (/dev/sev, /dev/tdx, SGX) unavailable so the report generation 500s; AAA misconfigured for the wrong hardware platform.","solutions":["Log the response body alongside the status code to get the AAA's error detail","Check AAA logs to see why it rejected the request (bad parameter vs internal hardware failure)","Update the AAA to a version compatible with the /aa/evidence?runtime_data= API and verify the TEE device is exposed to the container"],"exampleFix":"// before\nif resp.StatusCode != http.StatusOK {\n    return nil, fmt.Errorf(\"unexpected status code: %d\", resp.StatusCode)\n}\n// after\nif resp.StatusCode != http.StatusOK {\n    b, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))\n    return nil, fmt.Errorf(\"unexpected status code: %d, body: %s\", resp.StatusCode, b)\n}","handlingStrategy":"retry","validationCode":"resp, err := http.Get(confidentialContainerEvidenceUrl)\nif err == nil && resp.StatusCode != http.StatusOK { resp.Body.Close(); return fmt.Errorf(\"AAA returned %d, retry later\", resp.StatusCode) }","typeGuard":null,"tryCatchPattern":"ev, err := engine.GetEvidenceWithCCUrl()\nif err != nil {\n    var statusErr interface{ Error() string }\n    if strings.Contains(err.Error(), \"unexpected status code\") {\n        // exponential backoff retry; check AAA logs\n    }\n}","preventionTips":["Pin an AAA version compatible with /aa/evidence?runtime_data=","Verify the TEE device is mounted in the container","Log response bodies on non-200 to preserve AAA error details"],"tags":["http","attestation","status-code"],"backgroundTag":"http-non-200-response","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}