Trusted device required

{"record":{"id":"91ff733d76cfad92","repo":"gravitational/teleport","slug":"http-statustext-code-91ff73","errorCode":null,"errorMessage":"http.StatusText(code)","messagePattern":"http\\.StatusText\\(code\\)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/srv/app/connections_handler.go","lineNumber":901,"sourceCode":"\terr := c.getAndDeleteConnAuth(conn)\n\tif err == nil {\n\t\terr = c.serveHTTP(w, r)\n\t}\n\tif err != nil {\n\t\tc.log.WarnContext(c.closeContext, \"Failed to serve request\", \"error\", err)\n\n\t\t// Convert trace error type to HTTP and write response, make sure we close the\n\t\t// connection afterwards so that the monitor is recreated if needed.\n\t\tcode := trace.ErrorToCode(err)\n\t\tw.Header().Set(\"Connection\", \"close\")\n\n\t\tswitch {\n\t\tcase errors.Is(err, services.ErrTrustedDeviceRequired):\n\t\t\twriteTrustedDeviceRequired(w, r, code)\n\t\tcase errors.Is(err, services.ErrSessionMFARequired):\n\t\t\thttp.Error(w, authclient.ErrNoMFADevices.Error(), code)\n\t\tdefault:\n\t\t\thttp.Error(w, http.StatusText(code), code)\n\t\t}\n\t}\n}\n\nconst (\n\ttrustedDeviceRequiredDocsURL = \"https://goteleport.com/docs/zero-trust-access/device-trust/device-management/#troubleshooting\"\n\ttrustedDeviceRequiredWebUIDocsURL = \"https://goteleport.com/docs/zero-trust-access/device-trust/device-management/#web-ui-fails-to-authenticate-trusted-device\"\n\ttrustedDeviceRequiredAppAccessDocsURL = \"https://goteleport.com/docs/zero-trust-access/device-trust/device-management/#app-access-and-access-to-this-app-requires-a-trusted-device\"\n)\n\n// writeTrustedDeviceRequired writes the response body for a request that failed\n// with [services.ErrTrustedDeviceRequired]. Browsers receive a small HTML page\n// with clickable links to the docs; every other client gets plain text.\nfunc writeTrustedDeviceRequired(w http.ResponseWriter, r *http.Request, code int) {\n\tif isBrowserUserAgent(r.UserAgent()) {\n\t\tconst body = `\n\nTrusted device required","sourceCodeStart":883,"sourceCodeEnd":919,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/app/connections_handler.go#L883-L919","documentation":"In the app connections handler's ServeHTTP error path, this is the generic http.Error fallback writing the standard status text (http.StatusText of the trace-mapped code) as the body for any error not specially handled (trusted-device or MFA-device cases).","triggerScenarios":"Thrown at lib/srv/app/connections_handler.go:901 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the Teleport proxy logs for the underlying error behind the status code","Address the root cause per the status code (auth, permissions, not found) and retry the app request"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}