gravitational/teleport · error

Internal Server Error

Error message

Internal Server Error

What it means

TokenLimiter.ServeHTTP writes a plain 'Internal Server Error' (http.StatusText of 500) when it receives a request but no next handler was configured via Wrap — a misconfigured middleware chain rather than a rate-limit rejection.

Source

Thrown at lib/limiter/internal/ratelimit/ratelimit.go:101

			Clock: config.Clock,
		})
		if err != nil {
			return nil, trace.Wrap(err)
		}
		tl.bucketSets = bucketSets
	}

	return tl, nil
}

func (tl *TokenLimiter) Wrap(next http.Handler) {
	tl.next = next
}

func (tl *TokenLimiter) ServeHTTP(w http.ResponseWriter, req *http.Request) {
	if tl.next == nil {
		sc := http.StatusInternalServerError
		http.Error(w, http.StatusText(sc), sc)
		return
	}
	if tl.defaultRates.Len() == 0 {
		tl.next.ServeHTTP(w, req)
		return
	}

	clientIP, err := ExtractClientIP(req)
	if err != nil {
		ServeHTTPError(w, req, err)
		return
	}

	if err := tl.consumeRates(clientIP, 1 /* amount */); err != nil {
		tl.log.InfoContext(context.Background(), "limiting request",
			"method", req.Method, "url", req.URL.String(), "error", err)
		ServeHTTPError(w, req, err)
		return

View on GitHub (pinned to 1283425b60)

Solutions

1. Ensure the TokenLimiter is wrapped around a real handler via Wrap before it serves traffic
2. Review the middleware construction order in the service setup

When it happens

Trigger: Thrown at lib/limiter/internal/ratelimit/ratelimit.go:101 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• HTTP status errors: handling 4xx and 5xx responses — how to handle 4xx and 5xx responses properly.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/ef602e9c33c1dbc7. Report an issue: GitHub.