{"record":{"id":"a15a3fd0c5fb5d95","repo":"cloudflare/cloudflared","slug":"failed-to-read-auth-methods-v","errorCode":null,"errorMessage":"Failed to read auth methods: %v","messagePattern":"Failed to read auth methods: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks/auth_handler.go","lineNumber":50,"sourceCode":"// NewAuthHandler creates a default auth handler\nfunc NewAuthHandler() AuthHandler {\n\tdefaults := make(map[uint8]Authenticator)\n\tdefaults[NoAuth] = NewNoAuthAuthenticator()\n\treturn &StandardAuthHandler{\n\t\tauthenticators: defaults,\n\t}\n}\n\n// Register adds/replaces an Authenticator to use when handling Authentication requests\nfunc (h *StandardAuthHandler) Register(method uint8, a Authenticator) {\n\th.authenticators[method] = a\n}\n\n// Handle gets the methods from the SOCKS5 client and authenticates with the first supported method\nfunc (h *StandardAuthHandler) Handle(bufConn io.Reader, conn io.Writer) error {\n\tmethods, err := readMethods(bufConn)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed to read auth methods: %v\", err)\n\t}\n\n\t// first supported method is used\n\tfor _, method := range methods {\n\t\tauthenticator := h.authenticators[method]\n\t\tif authenticator != nil {\n\t\t\treturn authenticator.Handle(bufConn, conn)\n\t\t}\n\t}\n\n\t// failed to authenticate. No supported authentication type found\n\tconn.Write([]byte{socks5Version, noAcceptable})\n\treturn fmt.Errorf(\"unknown authentication type\")\n}\n\n// readMethods is used to read the number and type of methods\nfunc readMethods(r io.Reader) ([]byte, error) {\n\theader := []byte{0}","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/auth_handler.go#L32-L68","documentation":"StandardAuthHandler.Handle reads the SOCKS5 client's authentication method list via readMethods; if the underlying read fails (connection closed, malformed method-count header), the failure is wrapped with this message. It signals the auth negotiation phase could not complete.","triggerScenarios":"A SOCKS5 client disconnects or sends fewer bytes than the declared number of auth methods while the SOCKS server calls Handle.","commonSituations":"Non-SOCKS5 clients (health checkers, port scanners) hitting the SOCKS port; clients closing the connection immediately; network interruptions during handshake.","solutions":["Verify the client actually speaks SOCKS5 (version byte 0x05) before connecting to the proxy port.","Check client-side that the full method negotiation (count + method bytes) is written before awaiting a reply.","Retry the connection if it was a transient network issue.","Log the wrapped cause to distinguish EOF/reset from protocol garbage."],"exampleFix":"// before\nif err := authHandler.Handle(bufConn, conn); err != nil {\n    return err\n}\n// after\nif err := authHandler.Handle(bufConn, conn); err != nil {\n    logger.Debug().Err(err).Msg(\"socks auth negotiation failed; client likely not socks5\")\n    return err\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := h.authHandler.Handle(bufConn, conn); err != nil {\n    logger.Debug().Err(err).Msg(\"socks handshake failed\")\n    // close conn; do not treat as server error\n}","preventionTips":["Only connect SOCKS5-capable clients to the proxy port","Exclude the port from generic HTTP health checks","Handle EOF/reset as normal client disconnect","Log wrapped causes at debug level"],"tags":["socks5","authentication","network"],"backgroundTag":"http-request-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}