{"record":{"id":"5add5b1c1c5c3ba3","repo":"cloudflare/cloudflared","slug":"invalid-connection-override-s","errorCode":null,"errorMessage":"invalid connection override: %s","messagePattern":"invalid connection override: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/access/carrier.go","lineNumber":114,"sourceCode":"\t\tIsFedramp: c.Bool(fedrampFlag),\n\t}\n\n\tif connectTo := c.String(sshConnectTo); connectTo != \"\" {\n\t\tparts := strings.Split(connectTo, \":\")\n\t\tswitch len(parts) {\n\t\tcase 1:\n\t\t\toptions.OriginURL = fmt.Sprintf(\"https://%s\", parts[0])\n\t\tcase 2:\n\t\t\toptions.OriginURL = fmt.Sprintf(\"https://%s:%s\", parts[0], parts[1])\n\t\tcase 3:\n\t\t\toptions.OriginURL = fmt.Sprintf(\"https://%s:%s\", parts[2], parts[1])\n\t\t\toptions.TLSClientConfig = &tls.Config{\n\t\t\t\tInsecureSkipVerify: true, // #nosec G402\n\t\t\t\tServerName:         parts[0],\n\t\t\t}\n\t\t\tlog.Warn().Msgf(\"Using insecure SSL connection because SNI overridden to %s\", parts[0])\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid connection override: %s\", connectTo)\n\t\t}\n\t}\n\n\t// we could add a cmd line variable for this bool if we want the SOCK5 server to be on the client side\n\twsConn := carrier.NewWSConnection(log)\n\n\tif c.NArg() > 0 || c.IsSet(sshURLFlag) {\n\t\tforwarder, err := config.ValidateUrl(c, true)\n\t\tif err != nil {\n\t\t\tlog.Err(err).Msg(\"Error validating origin URL\")\n\t\t\treturn errors.Wrap(err, \"error validating origin URL\")\n\t\t}\n\t\tlog.Info().Str(LogFieldHost, forwarder.Host).Msg(\"Start Websocket listener\")\n\t\terr = carrier.StartForwarder(wsConn, forwarder.Host, shutdownC, options)\n\t\tif err != nil {\n\t\t\tlog.Err(err).Msg(\"Error on Websocket listener\")\n\t\t}\n\t\treturn err","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/access/carrier.go#L96-L132","documentation":"The ssh carrier command supports --connect-to / connection override strings with specific forms (host:port, or SNI overrides like 'sni:host'). When the override value does not match any known pattern, the switch's default branch returns 'invalid connection override'. It is a strict format validation of user-supplied connection options.","triggerScenarios":"Running `cloudflared access ssh --connect-to <value>` (or equivalent carrier invocation) with a value in an unrecognized format — e.g. too many/few colon-separated parts, or an unknown override prefix instead of the supported sni: form.","commonSituations":"Copy-pasting destination syntax from other tools (like ssh -L style specs); adding a scheme (https://host) where only host[:port] or sni:host is accepted; typos in the sni: prefix such as 'sni.' or 'SNI:'.","solutions":["Use the accepted formats: hostname, hostname:port, or sni:hostname for SNI override; remove schemes and extra colons.","Check `cloudflared access ssh --help` for the exact connect-to syntax of your version.","If you intended an SNI override, write it as `sni:<hostname>`; the insecure-SSL branch above handles exactly that form.","Validate the value in scripts (regex on host[:port]) before passing it to cloudflared."],"exampleFix":"// before\n$ cloudflared access ssh --hostname example.com --connect-to https://example.com:8443\n// after\n$ cloudflared access ssh --hostname example.com --connect-to example.com:8443","handlingStrategy":"validation","validationCode":"var connectToRe = regexp.MustCompile(`^(sni:[^:]+$|[^:]+(:\\d+)?)$`)\nif !connectToRe.MatchString(value) {\n\treturn fmt.Errorf(\"connect-to must be host[:port] or sni:host, got %q\", value)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never include URL schemes in --connect-to values","Use sni: prefix exactly (lowercase, with colon) for SNI overrides","Check --help for supported override syntax per cloudflared version","Validate override values in wrapper scripts"],"tags":["go","cli","access","ssh","validation"],"backgroundTag":"invalid-cli-argument","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}