cloudflare/cloudflared · error

JWKS response body exceeds %d bytes

Error message

JWKS response body exceeds %d bytes

What it means

Size-limit guard in fetchJWKS: the JWKS response body read via LimitReader exceeds maxJWKSResponseSize. This protects against a misbehaving or hostile endpoint returning an unbounded payload; the response is discarded rather than parsed.

Source

Thrown at token/jwks.go:119

		},
		Timeout: time.Second * 10,
	}
	resp, err := client.Get(jwksURL.String()) // nolint: gosec
	if err != nil {
		return nil, errors.Wrapf(err, "failed to fetch JWKS from %s", jwksURL.String())
	}
	defer func() { _ = resp.Body.Close() }()

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("JWKS endpoint %s returned status %d", jwksURL.String(), resp.StatusCode)
	}

	body, err := io.ReadAll(io.LimitReader(resp.Body, maxJWKSResponseSize+1))
	if err != nil {
		return nil, errors.Wrap(err, "failed to read JWKS response body")
	}
	if len(body) > maxJWKSResponseSize {
		return nil, fmt.Errorf("JWKS response body exceeds %d bytes", maxJWKSResponseSize)
	}

	var keySet jose.JSONWebKeySet
	if err := json.Unmarshal(body, &keySet); err != nil {
		return nil, errors.Wrap(err, "failed to parse JWKS")
	}
	return &keySet, nil
}

// jwksCachePath returns the on-disk path for cached JWKS for the given auth domain.
func jwksCachePath(authDomain url.URL) (string, error) {
	configPath, err := getConfigPath()
	if err != nil {
		return "", err
	}
	name := authDomain.Hostname() + jwksCacheSuffix
	return filepath.Join(configPath, name), nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Inspect what the endpoint actually returned — an oversized body indicates the wrong server or a compromised endpoint.
2. Verify the auth domain resolves to Cloudflare's certs endpoint.
3. No client-side fix; the limit is a deliberate safety bound.

When it happens

Trigger: Thrown at token/jwks.go:119 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/fb258caa15ada1f2. Report an issue: GitHub.