{"record":{"id":"ea5cfdbce2b3fcd1","repo":"cloudflare/cloudflared","slug":"invalid-http-status-code-d","errorCode":null,"errorMessage":"invalid HTTP status code: %d","messagePattern":"invalid HTTP status code: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":264,"sourceCode":"\trules := make([]Rule, len(ingress))\n\tfor i, r := range ingress {\n\t\tcfg := setConfig(defaults, r.OriginRequest)\n\t\tvar service OriginService\n\n\t\tif prefix := \"unix:\"; strings.HasPrefix(r.Service, prefix) {\n\t\t\t// No validation necessary for unix socket filepath services\n\t\t\tpath := strings.TrimPrefix(r.Service, prefix)\n\t\t\tservice = &unixSocketPath{path: path, scheme: \"http\"}\n\t\t} else if prefix := \"unix+tls:\"; strings.HasPrefix(r.Service, prefix) {\n\t\t\tpath := strings.TrimPrefix(r.Service, prefix)\n\t\t\tservice = &unixSocketPath{path: path, scheme: \"https\"}\n\t\t} else if prefix := \"http_status:\"; strings.HasPrefix(r.Service, prefix) {\n\t\t\tstatusCode, err := strconv.Atoi(strings.TrimPrefix(r.Service, prefix))\n\t\t\tif err != nil {\n\t\t\t\treturn Ingress{}, errors.Wrap(err, \"invalid HTTP status code\")\n\t\t\t}\n\t\t\tif statusCode < 100 || statusCode > 999 {\n\t\t\t\treturn Ingress{}, fmt.Errorf(\"invalid HTTP status code: %d\", statusCode)\n\t\t\t}\n\t\t\tsrv := newStatusCode(statusCode)\n\t\t\tservice = &srv\n\t\t} else if r.Service == HelloWorldFlag || r.Service == HelloWorldService {\n\t\t\tservice = new(helloWorld)\n\t\t} else if r.Service == ServiceSocksProxy {\n\t\t\trules := make([]ipaccess.Rule, len(r.OriginRequest.IPRules))\n\n\t\t\tfor i, ipRule := range r.OriginRequest.IPRules {\n\t\t\t\trule, err := ipaccess.NewRuleByCIDR(ipRule.Prefix, ipRule.Ports, ipRule.Allow)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn Ingress{}, fmt.Errorf(\"unable to create ip rule for %s: %s\", r.Service, err)\n\t\t\t\t}\n\t\t\t\trules[i] = rule\n\t\t\t}\n\n\t\t\taccessPolicy, err := ipaccess.NewPolicy(false, rules)\n\t\t\tif err != nil {","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L246-L282","documentation":"ingress rule validation rejects an `http_status:` service whose status code falls outside the valid HTTP range 100-999. validateIngress parses the number after the `http_status:` prefix with strconv.Atoi; if parsing succeeds but the value is <100 or >999, this error is returned because it cannot be a real HTTP status code. The rule is rejected and no Ingress value is produced.","triggerScenarios":"Calling ParseIngress or UnmarshalJSON on a config whose ingress rule has Service like `http_status:99`, `http_status:0`, `http_status:1000`, or `http_status:99999` (parseable integer but out of range).","commonSituations":"Typos in config.yaml (extra digit, negative value), templated configs where a variable renders as 0, or copy-pasted examples with placeholder status codes.","solutions":["Change the service value to a valid HTTP status code between 100 and 999, e.g. `service: http_status:404`","Check for config template variables that expand to 0 or empty-derived values","Validate the number before writing it into the ingress config"],"exampleFix":"// before\ningress:\n  - service: http_status:40\n// after\ningress:\n  - service: http_status:404","handlingStrategy":"validation","validationCode":"func validHTTPStatusService(svc string) bool {\n\tconst prefix = \"http_status:\"\n\tif !strings.HasPrefix(svc, prefix) { return true }\n\tcode, err := strconv.Atoi(strings.TrimPrefix(svc, prefix))\n\treturn err == nil && code >= 100 && code <= 999\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep a whitelist of allowed status codes in your config generator","Lint ingress configs in CI before deployment","Avoid templating status codes from unset variables"],"tags":["ingress","config-validation","http-status"],"backgroundTag":"invalid-config-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}