{"record":{"id":"90d97338b9725474","repo":"gravitational/teleport","slug":"proto-wrong-wiretype-d-for-field-browsermfatsh","errorCode":null,"errorMessage":"proto: wrong wireType = %d for field BrowserMFATSHRedirectURL","messagePattern":"proto: wrong wireType = (.+?) for field BrowserMFATSHRedirectURL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60311,"sourceCode":"\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tintStringLen := int(stringLen)\n\t\t\tif intStringLen < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tpostIndex := iNdEx + intStringLen\n\t\t\tif postIndex < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tif postIndex > l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tm.ProxyAddress = string(dAtA[iNdEx:postIndex])\n\t\t\tiNdEx = postIndex\n\t\tcase 9:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field BrowserMFATSHRedirectURL\", wireType)\n\t\t\t}\n\t\t\tvar stringLen uint64\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tstringLen |= uint64(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tintStringLen := int(stringLen)\n\t\t\tif intStringLen < 0 {","sourceCodeStart":60293,"sourceCodeEnd":60329,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60293-L60329","documentation":"The generated Unmarshal for the message containing BrowserMFATSHRedirectURL (field 9) only accepts wire type 2 (length-delimited string). Any other wire type on tag 9 makes the decoder return this error. It indicates schema mismatch between encoder and decoder or malformed input bytes.","triggerScenarios":"Deserializing a message whose field 9 (BrowserMFATSHRedirectURL) was encoded with a non-2 wire type — e.g. after the field was renumbered or retyped in a different proto revision — during client/auth-server RPC handling of browser MFA flows.","commonSituations":"Mixed-version teleport deployment where one node's generated pb.go still assigns field 9 to a different field; custom tooling that rewrites messages; corrupted gRPC frames behind a broken proxy; fuzz/hand-built payloads.","solutions":["Ensure all nodes/clients use the same api/client/proto generated code version","Re-run protoc codegen (or upgrade the module) so field numbering matches on both ends","Use protoc --decode_raw on the payload to inspect the actual wire type of field 9","Replace hand-crafted fixtures with bytes produced by proto.Marshal"],"exampleFix":"// before: fixture built by hand with wrong tag type\ndata := []byte{0x48, 0x01} // field 9 as varint\n// after: generate bytes with the real message\nmsg := &proto.SomeRequest{BrowserMFATSHRedirectURL: \"https://...\"}\ndata, _ := proto.Marshal(msg)","handlingStrategy":"try-catch","validationCode":"func nonEmptyBlob(b []byte) error {\n    if len(b) == 0 { return errors.New(\"empty payload\") }\n    return nil\n}","typeGuard":"func isProtoWireTypeMismatch(err error) bool {\n    var e *proto.MarshalRequiredFieldError // sentinel style\n    return err != nil && strings.Contains(err.Error(), \"wrong wireType\")\n}","tryCatchPattern":"var msg pb.MFARequest\nerr := proto.Unmarshal(blob, &msg)\nif err != nil && strings.Contains(err.Error(), \"wrong wireType\") {\n    return trace.BadParameter(\"peer proto schema differs; upgrade cluster nodes\")\n}","preventionTips":["Upgrade all cluster nodes together to avoid mixed pb.go schemas","Version-stamp serialized blobs and migrate on read","Fuzz-test decoders with malformed tags to fail fast","Keep gRPC framing intact (no manual byte slicing)"],"tags":["protobuf","grpc","wire-format","deserialization"],"backgroundTag":"proto-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}