{"record":{"id":"b1332c5bffcd9345","repo":"cloudflare/cloudflared","slug":"request-filtered-by-middleware-handler-s-due-to","errorCode":null,"errorMessage":"request filtered by middleware handler (%s) due to: %s","messagePattern":"request filtered by middleware handler \\((.+?)\\) due to: (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"proxy/proxy.go","lineNumber":72,"sourceCode":"\t\toriginDialer: originDialer,\n\t\ttags:         tags,\n\t\tflowLimiter:  flowLimiter,\n\t\tlog:          log,\n\t}\n\n\treturn proxy\n}\n\nfunc (p *Proxy) applyIngressMiddleware(rule *ingress.Rule, r *http.Request, w connection.ResponseWriter) (error, bool) {\n\tfor _, handler := range rule.Handlers {\n\t\tresult, err := handler.Handle(r.Context(), r)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, fmt.Sprintf(\"error while processing middleware handler %s\", handler.Name())), false\n\t\t}\n\n\t\tif result.ShouldFilterRequest {\n\t\t\t_ = w.WriteRespHeaders(result.StatusCode, nil)\n\t\t\treturn fmt.Errorf(\"request filtered by middleware handler (%s) due to: %s\", handler.Name(), result.Reason), true\n\t\t}\n\t}\n\treturn nil, true\n}\n\n// ProxyHTTP further depends on ingress rules to establish a connection with the origin service. This may be\n// a simple roundtrip or a tcp/websocket dial depending on ingres rule setup.\nfunc (p *Proxy) ProxyHTTP(\n\tw connection.ResponseWriter,\n\ttr *tracing.TracedHTTPRequest,\n\tisWebsocket bool,\n) error {\n\tincrementRequests()\n\tdefer decrementConcurrentRequests()\n\n\treq := tr.Request\n\tp.appendTagHeaders(req)\n\t_, ruleSpan := tr.Tracer().Start(req.Context(), \"ingress_match\",","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/proxy/proxy.go#L54-L90","documentation":"This error (with a boolean 'true' indicating the response was already written) is returned by applyIngressMiddleware when an ingress middleware handler decides the request should be filtered. cloudflared writes the middleware's status code to the client (WriteRespHeaders) and aborts proxying to the origin. The middleware name and its reason are embedded in the message.","triggerScenarios":"A middleware registered in the ingress configuration (e.g. access-control or blocklist style handlers) evaluates the request and returns result.ShouldFilterRequest == true, causing cloudflared to reject the request with result.StatusCode before reaching the origin service.","commonSituations":"See trigger scenarios.","solutions":["Read the 'due to:' reason and middleware name in the message to identify which rule rejected the request","Adjust the offending middleware's configuration (allow-lists, rules) in the ingress config to permit legitimate traffic","Verify client credentials/headers the middleware validates are being sent correctly","If the request should never be filtered, check for stale remote-config rules overriding local ingress settings"],"exampleFix":"// before (ingress config)\n// middleware rule blocks 10.0.0.0/8 entirely\n// after\n// add exception for the legitimate client\n// rules: [{cidr: 10.1.2.3/32, allow: true}, {cidr: 10.0.0.0/8, allow: false}]","handlingStrategy":"try-catch","validationCode":"// Simulate the middleware decision client-side before sending the request\nfor _, rule := range middlewareRules {\n    if rule.ShouldFilter(clientIP, reqHeaders) {\n        return fmt.Errorf(\"request would be filtered by %s: %s\", rule.Name, rule.Reason)\n    }\n}","typeGuard":null,"tryCatchPattern":"resp, err := doRequest(req)\nif err != nil && strings.Contains(err.Error(), \"request filtered by middleware handler\") {\n    var mwName, reason string\n    fmt.Sscanf(err.Error(), \"request filtered by middleware handler (%s) due to: %s\", &mwName, &reason)\n    log.Warn().Str(\"middleware\", mwName).Str(\"reason\", reason).Msg(\"request rejected pre-origin\")\n    return fmt.Errorf(\"blocked by %s: %s\", mwName, reason)\n}","preventionTips":["Keep ingress middleware allow-lists in sync with known client IPs/credentials","Test middleware rules with cloudflared's ingress validation and a staging tunnel","Check remote-config rules periodically for stale blocks causing unexpected 403s"],"tags":["go","proxy","middleware","request-filtered"],"backgroundTag":"http-error-response","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}