{"record":{"id":"6d7e72bc52d6a587","repo":"cloudflare/cloudflared","slug":"close-token-file-w","errorCode":null,"errorMessage":"close token file: %w","messagePattern":"close token file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cmd/cloudflared/windows_service.go","lineNumber":171,"sourceCode":"\t\tpathRaw,\n\t\twindows.GENERIC_WRITE,\n\t\t0,\n\t\t&windows.SecurityAttributes{\n\t\t\tLength:             uint32(unsafe.Sizeof(windows.SecurityAttributes{})),\n\t\t\tSecurityDescriptor: sd,\n\t\t\tInheritHandle:      0,\n\t\t},\n\t\twindows.CREATE_ALWAYS, // Will truncate the file if it exists\n\t\twindows.FILE_ATTRIBUTE_NORMAL,\n\t\t0,\n\t)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create token file: %w\", err)\n\t}\n\n\tif err := windows.CloseHandle(f); err != nil {\n\t\treturn fmt.Errorf(\"close token file: %w\", err)\n\t}\n\n\t// As with os.CreateFile / os.OpenFile on Unix, if the file already exists\n\t// windows.CreateFile will not update the permission information, so we do\n\t// that explicitly after creating the file.\n\n\towner, _, err := sd.Owner()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get token file owner: %w\", err)\n\t}\n\n\tdacl, _, err := sd.DACL()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get token file DACL: %w\", err)\n\t}\n\n\t// Bitmask indicating which security info we want to set on the file:\n\t//","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/windows_service.go#L153-L189","documentation":"After successfully creating the token file handle, createTokenFile releases it with windows.CloseHandle. If the Win32 CloseHandle call fails, cloudflared wraps the error with this message. This is a rare OS-level failure indicating the handle was invalid or already closed.","triggerScenarios":"windows.CloseHandle(f) returns an error after a successful windows.CreateFile in createTokenFile — the handle is invalid, duplicated, or the process is being torn down.","commonSituations":"Memory corruption or handle-table exhaustion on the host; the handle was already closed elsewhere (a code bug); running under a constrained sandbox/Job object that invalidates handles.","solutions":["Retry the service install — a transient handle issue usually resolves on a fresh run","Reboot the machine if handle exhaustion is suspected (check Process Explorer handle counts)","Verify no modified builds of cloudflared close the handle twice; rebuild from the official release","If it reproduces consistently, capture the wrapped Win32 error and file a cloudflared issue"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := createTokenFile(path); err != nil {\n\tif strings.Contains(err.Error(), \"close token file\") {\n\t\ttime.Sleep(500 * time.Millisecond)\n\t\treturn createTokenFile(path) // transient handle issues usually clear\n\t}\n\treturn err\n}","preventionTips":["Retry the service install once on this rare failure","Reboot if the machine shows handle exhaustion","Avoid unofficial/patched cloudflared builds that could double-close handles"],"tags":["windows","win32","handle-management"],"backgroundTag":"handle-close-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}