{"record":{"id":"abbad08b30605fb9","repo":"nats-io/nats-server","slug":"failed-to-read-proxy-response-v","errorCode":null,"errorMessage":"failed to read proxy response: %v","messagePattern":"failed to read proxy response: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":661,"sourceCode":"\t\tURL:    &url.URL{Opaque: targetHost}, // Opaque is required for CONNECT\n\t\tHost:   targetHost,\n\t\tHeader: make(http.Header),\n\t}\n\n\t// Add proxy authentication if provided\n\tif username != \"\" && password != \"\" {\n\t\treq.Header.Set(\"Proxy-Authorization\", \"Basic \"+base64.StdEncoding.EncodeToString([]byte(username+\":\"+password)))\n\t}\n\n\tif err := req.Write(conn); err != nil {\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to write CONNECT request: %v\", err)\n\t}\n\n\tresp, err := http.ReadResponse(bufio.NewReader(conn), req)\n\tif err != nil {\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to read proxy response: %v\", err)\n\t}\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tresp.Body.Close()\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"proxy CONNECT failed: %s\", resp.Status)\n\t}\n\n\t// Close the response body\n\tresp.Body.Close()\n\n\t// Clear the deadline now that we've finished the proxy handshake\n\tif err := conn.SetDeadline(time.Time{}); err != nil {\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to clear deadline: %v\", err)\n\t}\n\n\treturn conn, nil","sourceCodeStart":643,"sourceCodeEnd":679,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L643-L679","documentation":"Reading the proxy's HTTP response to the CONNECT request failed. http.ReadResponse returned an error — the proxy did not send a valid HTTP response before the deadline, closed the connection, or returned garbage that is not HTTP.","triggerScenarios":"establishHTTPProxyTunnel calls http.ReadResponse(bufio.NewReader(conn), req) and gets a parse/EOF/timeout error: endpoint is not actually an HTTP proxy, proxy hung up, response exceeded the deadline, or a TLS port (HTTPS) was targeted with an http:// proxy URL.","commonSituations":"Pointing proxy_url at a SOCKS or HTTPS-only proxy that never answers plain HTTP CONNECT; proxy behind an LB that silently drops idle connections; extremely slow proxy exceeding the deadline; DPI equipment mangling the stream.","solutions":["Confirm proxy_url uses the right scheme and the target is an HTTP CONNECT proxy (http:// for plain HTTP proxies)","Increase the proxy timeout if responses are slow","Capture traffic (tcpdump) to see what the proxy actually returns","Check proxy logs for why it dropped the connection"],"exampleFix":"// before\nproxy { url: \"http://proxy:1080\" }  // actually a SOCKS proxy\n// after\nproxy { url: \"http://proxy:3128\" }  // real HTTP proxy port","handlingStrategy":"validation","validationCode":"c, err := net.DialTimeout(\"tcp\", proxyHost, 3*time.Second)\nif err != nil { return err }\nfmt.Fprintf(c, \"CONNECT %s:443 HTTP/1.1\\r\\nHost: %s:443\\r\\n\\r\\n\", target, target)\nbuf := make([]byte, 128)\nn, _ := c.Read(buf)\nif !strings.HasPrefix(string(buf[:n]), \"HTTP/\") {\n    return fmt.Errorf(\"%s:%s is not an HTTP CONNECT proxy\", host, port)\n}\nc.Close()","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"failed to read proxy response\") {\n    log.Errorf(\"proxy did not answer HTTP CONNECT: %v — check proxy type/scheme\", err)\n}","preventionTips":["Ensure proxy_url scheme matches the proxy type (http:// for HTTP CONNECT proxies, not SOCKS ports)","Pre-flight test the CONNECT handshake against the proxy","Set the deadline generously for slow proxies","Verify nothing on-path corrupts the HTTP stream"],"tags":["network","proxy","http","response"],"backgroundTag":"proxy-connect-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}