{"record":{"id":"6f5f522a69caad8a","repo":"cloudflare/cloudflared","slug":"failed-to-fetch-resource","errorCode":null,"errorMessage":"Failed to fetch resource","messagePattern":"Failed to fetch resource","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/transfer.go","lineNumber":130,"sourceCode":"\tbaseURL.RawQuery = q.Encode() // and this actual baseURL.\n\tbaseURL.Path = \"cdn-cgi/access/cli\"\n\treturn baseURL.String(), nil\n}\n\n// transferRequest downloads the requested resource from the request URL\nfunc transferRequest(requestURL string, log *zerolog.Logger) ([]byte, string, error) {\n\tclient := &http.Client{Timeout: clientTimeout}\n\tconst pollAttempts = 10\n\t// we do \"long polling\" on the endpoint to get the resource.\n\tfor i := 0; i < pollAttempts; i++ {\n\t\tbuf, key, err := poll(client, requestURL, log)\n\t\tif err != nil {\n\t\t\treturn nil, \"\", err\n\t\t} else if len(buf) > 0 {\n\t\t\treturn buf, key, nil\n\t\t}\n\t}\n\treturn nil, \"\", errors.New(\"Failed to fetch resource\")\n}\n\n// poll the endpoint for the request resource, waiting for the user interaction\nfunc poll(client *http.Client, requestURL string, log *zerolog.Logger) ([]byte, string, error) {\n\treq, err := http.NewRequest(http.MethodGet, requestURL, nil)\n\tif err != nil {\n\t\treturn nil, \"\", err\n\t}\n\treq.Header.Set(userAgentHeader, userAgent)\n\tresp, err := client.Do(req) // nolint: gosec\n\tif err != nil {\n\t\treturn nil, \"\", err\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\t// ignore everything other than server errors as the resource\n\t// may not exist until the user does the interaction\n\tif resp.StatusCode >= 500 {","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/transfer.go#L112-L148","documentation":"transferRequest in token/transfer.go polls the Cloudflare Access CLI token-transfer endpoint up to 10 times ('long polling'), returning the payload as soon as a non-empty body arrives. If all 10 poll attempts complete with an empty body, it gives up with this sentinel error. It means the resource (the Access token) was never delivered to the transfer endpoint, i.e. the user never completed the browser login/authorization flow in time.","triggerScenarios":"RunTransfer -> transferRequest exhausts pollAttempts=10 iterations of poll() where each HTTP GET on the request URL succeeds but returns an empty body. No network error occurred — the transfer service simply had no token to hand out within the polling window.","commonSituations":"Running `cloudflared access login` (or a flow that uses LoginHelper token transfer) and not completing the browser authentication before the poll loop ends; the user closing or abandoning the browser tab; corporate SSO taking longer than the polling budget; the redirect back to the CLI endpoint failing silently so the token is never stored.","solutions":["Re-run the command and complete the browser authentication flow promptly (click through SSO before polling finishes).","Check that the browser successfully redirects back to the cdn-cgi/access/cli endpoint (watch for redirect errors or blocked popups).","Verify network/proxy settings allow the machine to reach the Cloudflare Access transfer endpoint from both browser and CLI.","Retry the login; if it recurs, increase the polling attempts/clientTimeout in token/transfer.go or capture zerolog debug output from poll() to see what the endpoint returns."],"exampleFix":"// before: give up after fixed attempts\nreturn nil, \"\", errors.New(\"Failed to fetch resource\")\n// after: give the user more time and a clearer message\nconst pollAttempts = 30\n...\nreturn nil, \"\", fmt.Errorf(\"did not receive token after %d polls; complete the browser login and retry\", pollAttempts)","handlingStrategy":"retry","validationCode":"if requestURL == \"\" {\n    return fmt.Errorf(\"no transfer URL provided; run cloudflared access login first\")\n}","typeGuard":null,"tryCatchPattern":"buf, key, err := transferRequest(url, log)\nif err != nil {\n    if err.Error() == \"Failed to fetch resource\" {\n        return fmt.Errorf(\"login not completed in time; rerun and finish browser auth: %w\", err)\n    }\n    return err\n}","preventionTips":["Complete the browser SSO promptly after launching the login command","Run the CLI in an environment where the default browser can open and redirect back","Check corporate proxies do not block the cdn-cgi/access/cli endpoint","Retry once before diagnosing deeper — transient SSO delays commonly cause it"],"tags":["authentication","timeout","polling","network"],"backgroundTag":"request-timeout","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}