gravitational/teleport · error

http.StatusText(code)

Error message

http.StatusText(code)

What it means

The Azure app handler's formatForwardResponseError writes the standard status text for the trace-mapped HTTP code as the response body when forwarding a request to the Azure API fails; the literal is the reason phrase for the mapped code.

Source

Thrown at lib/srv/app/azure/handler.go:164

	}
	recorder := httplib.NewResponseStatusRecorder(w)
	s.fwd.ServeHTTP(recorder, fwdRequest)
	status := uint32(recorder.Status())

	if err := sessionCtx.Audit.OnRequest(req.Context(), sessionCtx, fwdRequest, status, nil); err != nil {
		// log but don't return the error, because we already handed off request/response handling to the oxy forwarder.
		s.Log.WarnContext(req.Context(), "Failed to emit audit event.", "error", err)
	}
	return nil
}

func (s *handler) formatForwardResponseError(rw http.ResponseWriter, r *http.Request, err error) {
	s.Log.DebugContext(r.Context(), "Failed to process request.", "error", err)
	common.SetTeleportAPIErrorHeader(rw, err)

	// Convert trace error type to HTTP and write response.
	code := trace.ErrorToCode(err)
	http.Error(rw, http.StatusText(code), code)
}

// prepareForwardRequest prepares a request for forwarding, updating headers and target host. Several checks are made along the way.
//
// Do not read the request body but pass the reader as is, so that it streams.
// In Azure there is a threshold (aka max_single_put_size) which changes how the
// upload is performed. If the blob size is smaller than the threshold, the blob
// is uploaded in a single request. If however it's bigger than the threshold,
// it's uploaded in chunks.
//
// More details on the subject:
// https://learn.microsoft.com/en-us/azure/storage/blobs/scalability-targets
func (s *handler) prepareForwardRequest(r *http.Request, sessionCtx *common.SessionContext) (*http.Request, error) {
	forwardedHost, err := utils.GetSingleHeader(r.Header, "X-Forwarded-Host")
	if err != nil {
		return nil, trace.AccessDenied("%s", err)
	} else if !azure.IsAzureEndpoint(forwardedHost) {
		return nil, trace.AccessDenied("%q is not an Azure endpoint", forwardedHost)

View on GitHub (pinned to 1283425b60)

Solutions

1. Check the proxy logs for the underlying forward error
2. Verify the Azure app integration credentials and subscriptions
3. Address the root cause per the mapped status code and retry

When it happens

Trigger: Thrown at lib/srv/app/azure/handler.go:164 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/226cc95a16ee463e. Report an issue: GitHub.