{"record":{"id":"9866209e48073242","repo":"cloudflare/cloudflared","slug":"forbidden","errorCode":null,"errorMessage":"forbidden","messagePattern":"forbidden","errorType":"http","errorClass":null,"httpStatus":403,"severity":"info","filePath":"metrics/metrics.go","lineNumber":76,"sourceCode":"\tQuickTunnelHostname string\n\tOrchestrator        orchestrator\n\n\tShutdownTimeout time.Duration\n}\n\ntype orchestrator interface {\n\tGetVersionedConfigJSON() ([]byte, error)\n}\n\nfunc newMetricsHandler(\n\tconfig Config,\n\tlog *zerolog.Logger,\n) *http.ServeMux {\n\trouter := http.NewServeMux()\n\t// Block /debug/pprof/cmdline to prevent leaking secret command-line arguments\n\t// (e.g. tunnel tokens) that are exposed via os.Args.\n\trouter.HandleFunc(\"/debug/pprof/cmdline\", func(w http.ResponseWriter, r *http.Request) {\n\t\thttp.Error(w, \"forbidden\", http.StatusForbidden)\n\t})\n\trouter.Handle(\"/debug/\", http.DefaultServeMux)\n\trouter.Handle(\"/metrics\", promhttp.Handler())\n\trouter.HandleFunc(\"/healthcheck\", func(w http.ResponseWriter, r *http.Request) {\n\t\t_, _ = fmt.Fprintf(w, \"OK\\n\")\n\t})\n\tif config.ReadyServer != nil {\n\t\trouter.Handle(\"/ready\", config.ReadyServer)\n\t}\n\trouter.HandleFunc(\"/quicktunnel\", func(w http.ResponseWriter, r *http.Request) {\n\t\t_, _ = fmt.Fprintf(w, `{\"hostname\":\"%s\"}`, config.QuickTunnelHostname)\n\t})\n\tif config.Orchestrator != nil {\n\t\trouter.HandleFunc(\"/config\", func(w http.ResponseWriter, r *http.Request) {\n\t\t\tjson, err := config.Orchestrator.GetVersionedConfigJSON()\n\t\t\tif err != nil {\n\t\t\t\tw.WriteHeader(500)\n\t\t\t\t_, _ = fmt.Fprintf(w, \"ERR: %v\", err)","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/metrics/metrics.go#L58-L94","documentation":"The metrics server's router explicitly blocks /debug/pprof/cmdline and responds 'forbidden' with HTTP 403. This is intentional security behavior: the cmdline pprof endpoint would expose the full command line (os.Args), which can contain secret tunnel tokens or credentials. Hitting this error means you requested a deliberately disabled debug endpoint.","triggerScenarios":"An HTTP GET/POST to http://<metrics-host>:<metrics-port>/debug/pprof/cmdline on the cloudflared metrics listener returns 403 with body 'forbidden'.","commonSituations":"Developer profiling cloudflared with standard pprof tooling expects cmdline to work; security scanners flagging the endpoint; automation scraping all pprof endpoints; users unfamiliar with why this one endpoint is blocked while /debug/ itself is served.","solutions":["Do not rely on /debug/pprof/cmdline; use the process command line via ps/proc instead: ps -o args= -p $(pidof cloudflared)","Profile via the other pprof endpoints (/debug/pprof/profile, /debug/pprof/heap) which remain served under /debug/","If you need the flags, inspect your own deployment configuration or systemd unit rather than the endpoint","This is by design to prevent token leakage — do not attempt to bypass it; rotate any tokens you consider exposed"],"exampleFix":"// before: fetching command line via blocked endpoint\ncurl http://localhost:20241/debug/pprof/cmdline\n// after: read it from the process instead\nps -o args= -p \"$(pidof cloudflared)\"","handlingStrategy":"fallback","validationCode":"if strings.HasSuffix(pprofPath, \"/debug/pprof/cmdline\") {\n\t// skip: intentionally blocked by cloudflared metrics router (403)\n}","typeGuard":null,"tryCatchPattern":"resp, err := http.Get(metricsURL + \"/debug/pprof/profile?seconds=10\")\nif err == nil && resp.StatusCode == http.StatusForbidden {\n\t// cmdline/profile blocked: gather diagnostics from OS tooling instead\n}","preventionTips":["Never scrape /debug/pprof/cmdline on cloudflared; it is deliberately forbidden","Use ps/proc filesystem for command-line inspection","Restrict metrics endpoint access to trusted interfaces anyway","Rotate tokens if any secret was exposed through other debug channels"],"tags":["metrics","pprof","security","http-403"],"backgroundTag":"permission-denied","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}