{"record":{"id":"8a4ebc9101800c6f","repo":"gravitational/teleport","slug":"proto-wrong-wiretype-d-for-field-ssoclientredi","errorCode":null,"errorMessage":"proto: wrong wireType = %d for field SSOClientRedirectURL","messagePattern":"proto: wrong wireType = (.+?) for field SSOClientRedirectURL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60247,"sourceCode":"\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tpostIndex := iNdEx + msglen\n\t\t\tif postIndex < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tif postIndex > l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tif m.ChallengeExtensions == nil {\n\t\t\t\tm.ChallengeExtensions = &v12.ChallengeExtensions{}\n\t\t\t}\n\t\t\tif err := m.ChallengeExtensions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tiNdEx = postIndex\n\t\tcase 7:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field SSOClientRedirectURL\", wireType)\n\t\t\t}\n\t\t\tvar stringLen uint64\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tstringLen |= uint64(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tintStringLen := int(stringLen)\n\t\t\tif intStringLen < 0 {","sourceCodeStart":60229,"sourceCodeEnd":60265,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60229-L60265","documentation":"This error is thrown by generated gogoproto Unmarshal code in authservice.pb.go when decoding a protobuf message: field 7 (SSOClientRedirectURL, a string) must be encoded with wire type 2 (length-delimited), but the incoming bytes carry a different wire type. It means the binary payload is malformed or was produced by an incompatible schema/encoder. The library returns it immediately from Unmarshal without partially modifying the message.","triggerScenarios":"Calling Unmarshal (directly or via gRPC/transport deserialization) on bytes where field 7 of the target message (containing SSOClientRedirectURL, e.g. a PingRequest/AuthPreference-derived message) is encoded with a non-length-delimited wire type (varint 0, fixed64 1, fixed32 5, or group 3/4).","commonSituations":"Client and server built from different proto schema versions (field 7 renumbered or changed type); corrupted or truncated buffers; hand-crafted test fixtures; a proxy or middleware mangling binary frames; sending JSON/other encoding into a proto unmarshal path.","solutions":["Regenerate/upgrade api/client/proto on both sides so the sender and receiver share the same generated authservice.pb.go schema","Verify the bytes being unmarshaled actually come from Marshal of the same message type and were not truncated or base64/mis-encoded in transit","Inspect field 7 in the payload with protoc --decode_raw to confirm its wire type","If a middleware or cache touches payloads, ensure it passes the binary frame through unchanged"],"exampleFix":"// before: decoding with mismatched generated code\nerr := proto.Unmarshal(blob, &PingRequest{})\n// after: pin matching api/client/proto version on client and server\nimport \"github.com/gravitational/teleport/api/client/proto\"\nreq := &proto.PingRequest{}\nif err := proto.Unmarshal(blob, req); err != nil { return trace.Wrap(err) }","handlingStrategy":"validation","validationCode":"func validSSOClientRedirectURLField(b []byte) bool {\n    if len(b) == 0 { return false }\n    // walk tags; field 7 must have wire type 2\n    i := 0\n    for i < len(b) {\n        tag, n := binary.Uvarint(b[i:])\n        if n <= 0 { return false }\n        i += n\n        if int(tag>>3) == 7 && int(tag&0x7) != 2 { return false }\n        switch tag & 0x7 {\n        case 0:\n            _, n = binary.Uvarint(b[i:]); i += n\n        case 1:\n            i += 8\n        case 2:\n            l, n := binary.Uvarint(b[i:]); if n <= 0 { return false }; i += n + int(l)\n        case 5:\n            i += 4\n        default:\n            return false\n        }\n        if i > len(b) { return false }\n    }\n    return true\n}","typeGuard":"func isProtoUnmarshalWireTypeError(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"wrong wireType = \")\n}","tryCatchPattern":"var req pb.SomeRequest\nif err := proto.Unmarshal(blob, &req); err != nil {\n    if isProtoUnmarshalWireTypeError(err) {\n        return trace.BadParameter(\"payload incompatible with current schema; upgrade peer\")\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Pin identical api/client/proto module versions on client and server","Never hand-encode protobuf bytes; always use proto.Marshal on the typed struct","Use length-prefix framing when moving messages over raw streams","Add a CI check that regenerates pb.go and fails on diffs"],"tags":["protobuf","grpc","wire-format","deserialization"],"backgroundTag":"proto-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}