What causes "proto: wrong wireType = %d for field MFARequiredCheck" in gravitational/teleport?

Rebuild both sides from the same proto so field 5 is the same type

proto: wrong wireType = %d for field MFARequiredCheck

Error message

proto: wrong wireType = %d for field MFARequiredCheck

What it means

Protobuf unmarshal guard in generated code: while decoding CreateAuthenticateChallengeRequest, the MFARequiredCheck oneof field arrived with an unexpected wire type instead of the length-delimited type expected for a message.

Source

Thrown at api/client/proto/authservice.pb.go:60175

			if msglen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + msglen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			v := &Passwordless{}
			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
				return err
			}
			m.Request = &CreateAuthenticateChallengeRequest_Passwordless{v}
			iNdEx = postIndex
		case 5:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field MFARequiredCheck", wireType)
			}
			var msglen int
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				msglen |= int(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			if msglen < 0 {
				return ErrInvalidLengthAuthservice

View on GitHub (pinned to 1283425b60)

Solutions

Rebuild both sides from the same proto so field 5 is the same type
Set MFARequiredCheck through the generated struct and Marshal
Inspect the offending bytes with protoc --decode_raw
Regenerate stale generated code

Example fix

// before
// MFARequiredCheck serialized as bool
// after
m.MFARequiredCheck = &proto.MFARequiredCheck{Required: true}
b, _ := m.Marshal()

Defensive patterns

Strategy: validation

Validate before calling

// MFARequiredCheck is a message field; verify it is set as a struct, not a scalar
if req.MFARequiredCheck == nil { req.MFARequiredCheck = &proto.MFARequiredCheck{} }

Type guard

func hasMFARequiredCheck(r *proto.CreateAuthenticateChallengeRequest) bool {
  return r.GetMFARequiredCheck() != nil
}

Prevention

Treat MFARequiredCheck as a message; never encode it as a scalar
Update all peers when a field changes kind (scalar <-> message)
Add golden round-trip tests for every request type
Regenerate generated code as part of proto changes

When it happens

Trigger: Bytes where tag 5 is encoded with a wire type other than 2 — e.g. a proto version where MFARequiredCheck was a scalar, or corrupted/hand-built payloads.

Common situations: Client/server version skew after MFARequiredCheck changed kind; manual wire construction in tests; corruption in custom transports.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/98969e0ac406feb6. Report an issue: GitHub.