cloudflare/cloudflared · error

internal error: unsupported connection type

Error message

internal error: unsupported connection type

What it means

proxyHTTPRequest returns this when the origin responds with HTTP 101 Switching Protocols but the response body does not implement io.ReadWriteCloser, so cloudflared cannot splice a bidirectional stream. This is an internal invariant violation, not a user-configurable condition.

Source

Thrown at proxy/proxy.go:249

	headers := make(http.Header, len(resp.Header))
	// copy headers
	for k, v := range resp.Header {
		headers[k] = v
	}

	// Add spans to response header (if available)
	tr.AddSpans(headers)

	err = w.WriteRespHeaders(resp.StatusCode, headers)
	if err != nil {
		return errors.Wrap(err, "Error writing response header")
	}

	if resp.StatusCode == http.StatusSwitchingProtocols {
		rwc, ok := resp.Body.(io.ReadWriteCloser)
		if !ok {
			return errors.New("internal error: unsupported connection type")
		}
		defer func() { _ = rwc.Close() }()

		eyeballStream := &bidirectionalStream{
			writer: w,
			reader: tr.Body,
		}

		stream.Pipe(eyeballStream, rwc, logger)
		return nil
	}

	if _, err = cfio.Copy(w, resp.Body); err != nil {
		return err
	}

	// copy trailers
	copyTrailers(w, resp)

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Report this as a bug to cloudflared — it signals an unsupported internal transport type
2. Verify your cloudflared version is current; upgrade to pick up transport fixes
3. Work around by disabling the protocol upgrade on the origin (e.g. plain HTTP instead of websockets) to confirm the trigger

err := proxy.ProxyHTTP(w, r, isWebsocket)
if err != nil && strings.Contains(err.Error(), "unsupported connection type") {
    // report/upgrade; degrade gracefully e.g. reject the upgrade request
    http.Error(w, "protocol upgrade unsupported", http.StatusBadGateway)
}

When it happens

Trigger: resp.StatusCode == http.StatusSwitchingProtocols and the type assertion resp.Body.(io.ReadWriteCloser) fails in proxy/proxy.go, called from ProxyHTTP.

Common situations: Websocket or other protocol-upgrade requests proxied through a transport whose response body type does not support raw read/write access (e.g. unexpected transport change or Go version behavior).

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• Failed to proxy HTTP: %w
• status not yet written before attempting to hijack connectio
• ErrAPINoSuccess
• Failed to fetch page. Server returned: %d
• write to closed websocket connection

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/56c20ef668ba28b3. Report an issue: GitHub.