gravitational/teleport · error

http.StatusText(code)

Error message

http.StatusText(code)

What it means

In the app connections handler's ServeHTTP error path, this is the generic http.Error fallback writing the standard status text (http.StatusText of the trace-mapped code) as the body for any error not specially handled (trusted-device or MFA-device cases).

Source

Thrown at lib/srv/app/connections_handler.go:901

	err := c.getAndDeleteConnAuth(conn)
	if err == nil {
		err = c.serveHTTP(w, r)
	}
	if err != nil {
		c.log.WarnContext(c.closeContext, "Failed to serve request", "error", err)

		// Convert trace error type to HTTP and write response, make sure we close the
		// connection afterwards so that the monitor is recreated if needed.
		code := trace.ErrorToCode(err)
		w.Header().Set("Connection", "close")

		switch {
		case errors.Is(err, services.ErrTrustedDeviceRequired):
			writeTrustedDeviceRequired(w, r, code)
		case errors.Is(err, services.ErrSessionMFARequired):
			http.Error(w, authclient.ErrNoMFADevices.Error(), code)
		default:
			http.Error(w, http.StatusText(code), code)
		}
	}
}

const (
	trustedDeviceRequiredDocsURL          = "https://goteleport.com/docs/zero-trust-access/device-trust/device-management/#troubleshooting"
	trustedDeviceRequiredWebUIDocsURL     = "https://goteleport.com/docs/zero-trust-access/device-trust/device-management/#web-ui-fails-to-authenticate-trusted-device"
	trustedDeviceRequiredAppAccessDocsURL = "https://goteleport.com/docs/zero-trust-access/device-trust/device-management/#app-access-and-access-to-this-app-requires-a-trusted-device"
)

// writeTrustedDeviceRequired writes the response body for a request that failed
// with [services.ErrTrustedDeviceRequired]. Browsers receive a small HTML page
// with clickable links to the docs; every other client gets plain text.
func writeTrustedDeviceRequired(w http.ResponseWriter, r *http.Request, code int) {
	if isBrowserUserAgent(r.UserAgent()) {
		const body = `<!DOCTYPE html>
<html lang="en">
<head><meta charset="utf-8"><title>Trusted device required</title></head>

View on GitHub (pinned to 1283425b60)

Solutions

  1. Check the Teleport proxy logs for the underlying error behind the status code
  2. Address the root cause per the status code (auth, permissions, not found) and retry the app request
Defensive patterns

Strategy: fallback

When it happens

Trigger: Thrown at lib/srv/app/connections_handler.go:901 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/91ff733d76cfad92. Report an issue: GitHub.