cloudflared received a warp-routing request with an empty ho

Error message

cloudflared received a warp-routing request with an empty host value: %w

What it means

When an incoming request on the HTTP/2 connection has type TypeTCP (warp-routing), ServeHTTP extracts the request host via getRequestHost. If the Host header is empty or unparseable, it wraps the error as `cloudflared received a warp-routing request with an empty host value`. Warp-routing needs the host to know the TCP destination, so a request without one cannot be routed.

Source

Thrown at connection/http2.go:140

		if requestErr != nil {
			c.controlStreamErr = requestErr
		}

	case TypeConfiguration:
		requestErr = c.handleConfigurationUpdate(respWriter, r)

	case TypeWebsocket, TypeHTTP:
		stripWebsocketUpgradeHeader(r)
		// Check for tracing on request
		tr := tracing.NewTracedHTTPRequest(r, c.connIndex, c.log)
		if err := originProxy.ProxyHTTP(respWriter, tr, connType == TypeWebsocket); err != nil {
			requestErr = fmt.Errorf("Failed to proxy HTTP: %w", err)
		}

	case TypeTCP:
		host, err := getRequestHost(r)
		if err != nil {
			requestErr = fmt.Errorf(`cloudflared received a warp-routing request with an empty host value: %w`, err)
			break
		}

		rws := NewHTTPResponseReadWriterAcker(respWriter, respWriter, r)
		requestErr = originProxy.ProxyTCP(r.Context(), rws, &TCPRequest{
			Dest:      host,
			CFRay:     FindCfRayHeader(r),
			LBProbe:   IsLBProbeRequest(r),
			CfTraceID: r.Header.Get(tracing.TracerContextName),
			ConnIndex: c.connIndex,
		})

	default:
		requestErr = fmt.Errorf("Received unknown connection type: %s", connType)
	}

	if requestErr != nil {
		c.log.Error().Err(requestErr).Msg("failed to serve incoming request")

View on GitHub (pinned to 2253eeeb25)

Solutions

Ensure the WARP client / originating request includes a valid Host header
Verify warp-routing is enabled for the tunnel (`cloudflared tunnel route ip add ...`) and traffic reaches it as intended
Check client-side proxy configuration so it does not strip the Host header
Update cloudflared and the WARP client to current versions

Defensive patterns

Strategy: validation

Validate before calling

if r.Host == "" { // caller-side guard before routing warp traffic
    return errors.New("warp-routing request requires a Host header")
}

Try / catch

if err != nil && strings.Contains(err.Error(), "empty host value") {
    log.Warn().Err(err).Msg("dropping warp request without host header")
    return
}

Prevention

Ensure WARP client traffic always carries a Host header
Enable warp-routing only for tunnels whose clients set proper headers
Keep WARP client and cloudflared versions current

When it happens

Trigger: A warp-routing request arrives with connection type TypeTCP and getRequestHost returns an error because the request's Host header is empty or invalid, before ProxyTCP is invoked.

Common situations: WARP client routing traffic where the SNI/Host header is stripped or empty, misconfigured warp routing on the Cloudflare side, or a client sending raw TCP requests through the tunnel without a valid host.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/4d5f7ca28f8ae16f. Report an issue: GitHub.