cloudflare/cloudflared · error

invalid HTTP status code: %d

Error message

invalid HTTP status code: %d

What it means

ingress rule validation rejects an `http_status:` service whose status code falls outside the valid HTTP range 100-999. validateIngress parses the number after the `http_status:` prefix with strconv.Atoi; if parsing succeeds but the value is <100 or >999, this error is returned because it cannot be a real HTTP status code. The rule is rejected and no Ingress value is produced.

Source

Thrown at ingress/ingress.go:264

	rules := make([]Rule, len(ingress))
	for i, r := range ingress {
		cfg := setConfig(defaults, r.OriginRequest)
		var service OriginService

		if prefix := "unix:"; strings.HasPrefix(r.Service, prefix) {
			// No validation necessary for unix socket filepath services
			path := strings.TrimPrefix(r.Service, prefix)
			service = &unixSocketPath{path: path, scheme: "http"}
		} else if prefix := "unix+tls:"; strings.HasPrefix(r.Service, prefix) {
			path := strings.TrimPrefix(r.Service, prefix)
			service = &unixSocketPath{path: path, scheme: "https"}
		} else if prefix := "http_status:"; strings.HasPrefix(r.Service, prefix) {
			statusCode, err := strconv.Atoi(strings.TrimPrefix(r.Service, prefix))
			if err != nil {
				return Ingress{}, errors.Wrap(err, "invalid HTTP status code")
			}
			if statusCode < 100 || statusCode > 999 {
				return Ingress{}, fmt.Errorf("invalid HTTP status code: %d", statusCode)
			}
			srv := newStatusCode(statusCode)
			service = &srv
		} else if r.Service == HelloWorldFlag || r.Service == HelloWorldService {
			service = new(helloWorld)
		} else if r.Service == ServiceSocksProxy {
			rules := make([]ipaccess.Rule, len(r.OriginRequest.IPRules))

			for i, ipRule := range r.OriginRequest.IPRules {
				rule, err := ipaccess.NewRuleByCIDR(ipRule.Prefix, ipRule.Ports, ipRule.Allow)
				if err != nil {
					return Ingress{}, fmt.Errorf("unable to create ip rule for %s: %s", r.Service, err)
				}
				rules[i] = rule
			}

			accessPolicy, err := ipaccess.NewPolicy(false, rules)
			if err != nil {

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Change the service value to a valid HTTP status code between 100 and 999, e.g. `service: http_status:404`
2. Check for config template variables that expand to 0 or empty-derived values
3. Validate the number before writing it into the ingress config

Example fix

// before
ingress:
  - service: http_status:40
// after
ingress:
  - service: http_status:404

func validHTTPStatusService(svc string) bool {
	const prefix = "http_status:"
	if !strings.HasPrefix(svc, prefix) { return true }
	code, err := strconv.Atoi(strings.TrimPrefix(svc, prefix))
	return err == nil && code >= 100 && code <= 999
}

When it happens

Trigger: Calling ParseIngress or UnmarshalJSON on a config whose ingress rule has Service like `http_status:99`, `http_status:0`, `http_status:1000`, or `http_status:99999` (parseable integer but out of range).

Common situations: Typos in config.yaml (extra digit, negative value), templated configs where a variable renders as 0, or copy-pasted examples with placeholder status codes.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• invalid HTTP status code
• Rule #%d has an invalid regex
• No configuration file was found. Please create one, or use t
• cloudflared tunnel rule expects a single argument, the URL t
• ErrNoIngressRules

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/ea5cfdbce2b3fcd1. Report an issue: GitHub.