{"record":{"id":"6e077f1279131daa","repo":"cloudflare/cloudflared","slug":"did-not-receive-final-destination-from-client-the","errorCode":null,"errorMessage":"Did not receive final destination from client. The --destination flag is likely not set on the client side","messagePattern":"Did not receive final destination from client\\. The --destination flag is likely not set on the client side","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"carrier/carrier.go","lineNumber":174,"sourceCode":"\tfor k, v := range options.Headers {\n\t\tif len(v) >= 1 {\n\t\t\toriginRequest.Header.Set(k, v[0])\n\t\t}\n\t}\n\n\treturn originRequest, nil\n}\n\nfunc SetBastionDest(header http.Header, destination string) {\n\tif destination != \"\" {\n\t\theader.Set(cfJumpDestinationHeader, destination)\n\t}\n}\n\nfunc ResolveBastionDest(r *http.Request) (string, error) {\n\tjumpDestination := r.Header.Get(cfJumpDestinationHeader)\n\tif jumpDestination == \"\" {\n\t\treturn \"\", fmt.Errorf(\"Did not receive final destination from client. The --destination flag is likely not set on the client side\")\n\t}\n\t// Strip scheme and path set by client. Without a scheme\n\t// Parsing a hostname and path without scheme might not return an error due to parsing ambiguities\n\tif jumpURL, err := url.Parse(jumpDestination); err == nil && jumpURL.Host != \"\" {\n\t\treturn removePath(jumpURL.Host), nil\n\t}\n\treturn removePath(jumpDestination), nil\n}\n\nfunc removePath(dest string) string {\n\treturn strings.SplitN(dest, \"/\", 2)[0]\n}\n","sourceCodeStart":156,"sourceCodeEnd":187,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/carrier/carrier.go#L156-L187","documentation":"carrier.ResolveBastionDest reads the Cf-Jump-Target-Destination header that the cloudflared client sets when using bastion mode (`cloudflared access ssh --destination ...`). If the header is empty, the edge/carrier side cannot know which final host to jump to and returns this error. It is a client configuration problem, not a server fault.","triggerScenarios":"ResolveBastionDest(r) is called on an incoming websocket request in bastion mode and r.Header.Get(cfJumpDestinationHeader) returns \"\" — i.e. the request arrived without the jump-destination header because the client did not send one.","commonSituations":"User runs `cloudflared access ssh` or TCP-over-WS without the --destination flag (or with an empty value); an older client version that doesn't send the header connecting to a newer server; a proxy/load balancer stripping custom Cf-* headers; hitting the bastion URL with a plain HTTP client instead of `cloudflared access`.","solutions":["Set the --destination flag on the client command, e.g. `cloudflared access ssh --hostname bastion.example.com --destination internal-host:22`.","Upgrade the client cloudflared to a version that sends the Cf-Jump-Target-Destination header.","Ensure intermediate proxies/WAF rules do not strip Cf-Jump-* headers from the request.","If resolving the destination from access rules (getDestFromRule), configure the rule's destination so a value exists."],"exampleFix":"// before\ncloudflared access ssh --hostname bastion.example.com\n// after\ncloudflared access ssh --hostname bastion.example.com --destination internal-server.internal:22","handlingStrategy":"validation","validationCode":"// client side, before opening the bastion session\nif destination == \"\" {\n    return fmt.Errorf(\"--destination is required in bastion mode, e.g. --destination host:22\")\n}","typeGuard":null,"tryCatchPattern":"dest, err := carrier.ResolveBastionDest(req)\nif err != nil {\n    http.Error(w, err.Error(), http.StatusBadRequest)\n    return\n}","preventionTips":["Always pass --destination when using `cloudflared access ssh`/tcp in bastion mode","Pin matching client and server cloudflared versions","Verify proxies preserve Cf-Jump-* custom headers","Test the bastion route with a known-good command before scripting it"],"tags":["bastion","missing-flag","cli","configuration"],"backgroundTag":"missing-required-flag","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}