{"record":{"id":"f5048ca97b57ec87","repo":"oauth2-proxy/oauth2-proxy","slug":"error-performing-request-v","errorCode":null,"errorMessage":"error performing request: %v","messagePattern":"error performing request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/requests/builder.go","lineNumber":104,"sourceCode":"\t\tr.context = context.Background()\n\t}\n\n\treturn r.do()\n}\n\n// do creates the request, executes it with the default client and extracts the\n// the body into the response\nfunc (r *builder) do() Result {\n\treq, err := http.NewRequestWithContext(r.context, r.method, r.endpoint, r.body)\n\tif err != nil {\n\t\tr.result = &result{err: fmt.Errorf(\"error creating request: %v\", err)}\n\t\treturn r.result\n\t}\n\treq.Header = r.header\n\n\tresp, err := DefaultHTTPClient.Do(req)\n\tif err != nil {\n\t\tr.result = &result{err: fmt.Errorf(\"error performing request: %v\", err)}\n\t\treturn r.result\n\t}\n\n\tdefer resp.Body.Close()\n\tbody, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\tr.result = &result{err: fmt.Errorf(\"error reading response body: %v\", err)}\n\t\treturn r.result\n\t}\n\n\tr.result = &result{response: resp, body: body}\n\treturn r.result\n}\n","sourceCodeStart":86,"sourceCodeEnd":118,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/requests/builder.go#L86-L118","documentation":"The requests builder wraps any error returned by DefaultHTTPClient.Do(req) when the HTTP request is actually performed. This is a transport-level failure: DNS resolution, TCP connect, TLS handshake, timeouts, or the request context being cancelled — the server may not even be reachable. The wrapped error contains the underlying net/http cause.","triggerScenarios":"Calling Do() on a request builder when the target host does not resolve or is unreachable, the TLS certificate is invalid, the context deadline (WithCancel/Timeout) expires mid-request, or the connection is reset before a response arrives.","commonSituations":"Misconfigured provider hostname/port in oauth2-proxy config; calling internal endpoints from an environment without network access; upstream TLS certificates not trusted by the container's CA bundle; context timeouts too short for slow upstreams.","solutions":["Read the wrapped error to distinguish DNS failure, connection refused, TLS error, or context deadline","Verify the endpoint host/port is reachable (curl / getent hosts) from the proxy's environment","Check the context timeout passed to the builder — increase it if the upstream is slow","Fix the CA bundle / certificate chain if the cause is a TLS verification error, and add retry logic for transient network failures"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight reachability check\nconn, err := net.DialTimeout(\"tcp\", host, 5*time.Second)\nif err != nil {\n    return fmt.Errorf(\"upstream %s unreachable: %w\", host, err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"res := requests.New(ctx).WithMethod(\"GET\").WithEndpoint(u).Do()\nif res.Error() != nil {\n    var netErr net.Error\n    if errors.As(res.Error(), &netErr) && netErr.Timeout() {\n        // retry with backoff or extend the context deadline\n    }\n    return res.Error()\n}","preventionTips":["Set a realistic context timeout for slow upstreams","Monitor DNS/connectivity from the proxy's network namespace","Install the upstream CA chain into the container trust store","Implement bounded retry with exponential backoff for transient transport errors"],"tags":["http","network","request","timeout"],"backgroundTag":"http-request-failed","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}