gravitational/teleport · error

proto: wrong wireType = %d for field BrowserMFATSHRedirectUR

Error message

proto: wrong wireType = %d for field BrowserMFATSHRedirectURL

What it means

The generated Unmarshal for the message containing BrowserMFATSHRedirectURL (field 9) only accepts wire type 2 (length-delimited string). Any other wire type on tag 9 makes the decoder return this error. It indicates schema mismatch between encoder and decoder or malformed input bytes.

Source

Thrown at api/client/proto/authservice.pb.go:60311

					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + intStringLen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			m.ProxyAddress = string(dAtA[iNdEx:postIndex])
			iNdEx = postIndex
		case 9:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field BrowserMFATSHRedirectURL", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)

Solutions

1. Ensure all nodes/clients use the same api/client/proto generated code version
2. Re-run protoc codegen (or upgrade the module) so field numbering matches on both ends
3. Use protoc --decode_raw on the payload to inspect the actual wire type of field 9
4. Replace hand-crafted fixtures with bytes produced by proto.Marshal

Example fix

// before: fixture built by hand with wrong tag type
data := []byte{0x48, 0x01} // field 9 as varint
// after: generate bytes with the real message
msg := &proto.SomeRequest{BrowserMFATSHRedirectURL: "https://..."}
data, _ := proto.Marshal(msg)

func nonEmptyBlob(b []byte) error {
    if len(b) == 0 { return errors.New("empty payload") }
    return nil
}

func isProtoWireTypeMismatch(err error) bool {
    var e *proto.MarshalRequiredFieldError // sentinel style
    return err != nil && strings.Contains(err.Error(), "wrong wireType")
}

var msg pb.MFARequest
err := proto.Unmarshal(blob, &msg)
if err != nil && strings.Contains(err.Error(), "wrong wireType") {
    return trace.BadParameter("peer proto schema differs; upgrade cluster nodes")
}

When it happens

Trigger: Deserializing a message whose field 9 (BrowserMFATSHRedirectURL) was encoded with a non-2 wire type — e.g. after the field was renumbered or retyped in a different proto revision — during client/auth-server RPC handling of browser MFA flows.

Common situations: Mixed-version teleport deployment where one node's generated pb.go still assigns field 9 to a different field; custom tooling that rewrites messages; corrupted gRPC frames behind a broken proxy; fuzz/hand-built payloads.

Related errors

• proto: Passwordless: wiretype end group for non-group
• proto: Passwordless: illegal tag %d (wire type %d)
• proto: CreateAuthenticateChallengeRequest: wiretype end grou
• proto: wrong wireType = %d for field SSOClientRedirectURL
• proto: wrong wireType = %d for field ProxyAddress

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/90d97338b9725474. Report an issue: GitHub.