gravitational/teleport · error

http.StatusText(trace.ErrorToCode(err))

Error message

http.StatusText(trace.ErrorToCode(err))

What it means

In deviceWebConfirm, after attempting to enroll/confirm a device and redirecting back to the dashboard, any redirect-URL or finalization failure results in writing the standard status text for the trace-mapped code of that error.

Source

Thrown at lib/web/device_trust.go:91

		// err swallowed on purpose.
	default:
		// Preemptively release session from cache, as its certificates are now
		// updated.
		// The WebSession watcher takes care of this in other proxy instances
		// (see [sessionCache.watchWebSessions]).
		h.auth.releaseResources(r.Context(), sessionCtx.GetUser(), sessionCtx.GetSessionID())
	}

	// Always redirect back to the dashboard, regardless of outcome.
	app.SetRedirectPageHeaders(w.Header(), "" /* nonce */)

	redirectTo, err := h.getRedirectURL(r.Host, unsafeRedirectURI)
	if err != nil {
		h.logger.DebugContext(ctx, "Unable to parse redirectURI",
			"error", err,
			"redirect_uri", unsafeRedirectURI,
		)
		http.Error(w, http.StatusText(trace.ErrorToCode(err)), trace.ErrorToCode(err))
		return nil, nil
	}
	http.Redirect(w, r, redirectTo, http.StatusSeeOther)

	return nil, nil
}

// getRedirectPath tries to parse the given unsafeRedirectURI.
// It returns a full URL if the unsafeRedirectURI points to SAML IdP SSO endpoint.
// In any other case, as long as the redirect URL is parsable, it returns
// a path ensuring its prefixed with "/web".
//
// Nobody seems to know why we need to prepend the base path to the URL, so we keep doing it. It
// might be related to the URLs we get from SSO redirects [1], but it's unclear why we'd be getting
// a URL that's missing the base path and becomes valid only after appending the base path.
//
// [1]: https://github.com/gravitational/teleport/pull/47221#discussion_r1792248868
func (h *Handler) getRedirectURL(host, unsafeRedirectURI string) (string, error) {

View on GitHub (pinned to 1283425b60)

Solutions

1. Check the web proxy logs for the device enrollment confirmation error
2. Verify the redirect URI is allowed and well-formed
3. Retry the device confirmation flow from the devices page

When it happens

Trigger: Thrown at lib/web/device_trust.go:91 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/5937e1105cc5bc80. Report an issue: GitHub.