{"record":{"id":"5937e1105cc5bc80","repo":"gravitational/teleport","slug":"http-statustext-trace-errortocode-err","errorCode":null,"errorMessage":"http.StatusText(trace.ErrorToCode(err))","messagePattern":"http\\.StatusText\\(trace\\.ErrorToCode\\(err\\)\\)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/web/device_trust.go","lineNumber":91,"sourceCode":"\t\t// err swallowed on purpose.\n\tdefault:\n\t\t// Preemptively release session from cache, as its certificates are now\n\t\t// updated.\n\t\t// The WebSession watcher takes care of this in other proxy instances\n\t\t// (see [sessionCache.watchWebSessions]).\n\t\th.auth.releaseResources(r.Context(), sessionCtx.GetUser(), sessionCtx.GetSessionID())\n\t}\n\n\t// Always redirect back to the dashboard, regardless of outcome.\n\tapp.SetRedirectPageHeaders(w.Header(), \"\" /* nonce */)\n\n\tredirectTo, err := h.getRedirectURL(r.Host, unsafeRedirectURI)\n\tif err != nil {\n\t\th.logger.DebugContext(ctx, \"Unable to parse redirectURI\",\n\t\t\t\"error\", err,\n\t\t\t\"redirect_uri\", unsafeRedirectURI,\n\t\t)\n\t\thttp.Error(w, http.StatusText(trace.ErrorToCode(err)), trace.ErrorToCode(err))\n\t\treturn nil, nil\n\t}\n\thttp.Redirect(w, r, redirectTo, http.StatusSeeOther)\n\n\treturn nil, nil\n}\n\n// getRedirectPath tries to parse the given unsafeRedirectURI.\n// It returns a full URL if the unsafeRedirectURI points to SAML IdP SSO endpoint.\n// In any other case, as long as the redirect URL is parsable, it returns\n// a path ensuring its prefixed with \"/web\".\n//\n// Nobody seems to know why we need to prepend the base path to the URL, so we keep doing it. It\n// might be related to the URLs we get from SSO redirects [1], but it's unclear why we'd be getting\n// a URL that's missing the base path and becomes valid only after appending the base path.\n//\n// [1]: https://github.com/gravitational/teleport/pull/47221#discussion_r1792248868\nfunc (h *Handler) getRedirectURL(host, unsafeRedirectURI string) (string, error) {","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/web/device_trust.go#L73-L109","documentation":"In deviceWebConfirm, after attempting to enroll/confirm a device and redirecting back to the dashboard, any redirect-URL or finalization failure results in writing the standard status text for the trace-mapped code of that error.","triggerScenarios":"Thrown at lib/web/device_trust.go:91 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the web proxy logs for the device enrollment confirmation error","Verify the redirect URI is allowed and well-formed","Retry the device confirmation flow from the devices page"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}