gravitational/teleport · error

proto: wrong wireType = %d for field SSOClientRedirectURL

Error message

proto: wrong wireType = %d for field SSOClientRedirectURL

What it means

This error is thrown by generated gogoproto Unmarshal code in authservice.pb.go when decoding a protobuf message: field 7 (SSOClientRedirectURL, a string) must be encoded with wire type 2 (length-delimited), but the incoming bytes carry a different wire type. It means the binary payload is malformed or was produced by an incompatible schema/encoder. The library returns it immediately from Unmarshal without partially modifying the message.

Source

Thrown at api/client/proto/authservice.pb.go:60247

				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + msglen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			if m.ChallengeExtensions == nil {
				m.ChallengeExtensions = &v12.ChallengeExtensions{}
			}
			if err := m.ChallengeExtensions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
				return err
			}
			iNdEx = postIndex
		case 7:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field SSOClientRedirectURL", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)

Solutions

  1. Regenerate/upgrade api/client/proto on both sides so the sender and receiver share the same generated authservice.pb.go schema
  2. Verify the bytes being unmarshaled actually come from Marshal of the same message type and were not truncated or base64/mis-encoded in transit
  3. Inspect field 7 in the payload with protoc --decode_raw to confirm its wire type
  4. If a middleware or cache touches payloads, ensure it passes the binary frame through unchanged

Example fix

// before: decoding with mismatched generated code
err := proto.Unmarshal(blob, &PingRequest{})
// after: pin matching api/client/proto version on client and server
import "github.com/gravitational/teleport/api/client/proto"
req := &proto.PingRequest{}
if err := proto.Unmarshal(blob, req); err != nil { return trace.Wrap(err) }
Defensive patterns

Strategy: validation

Validate before calling

func validSSOClientRedirectURLField(b []byte) bool {
    if len(b) == 0 { return false }
    // walk tags; field 7 must have wire type 2
    i := 0
    for i < len(b) {
        tag, n := binary.Uvarint(b[i:])
        if n <= 0 { return false }
        i += n
        if int(tag>>3) == 7 && int(tag&0x7) != 2 { return false }
        switch tag & 0x7 {
        case 0:
            _, n = binary.Uvarint(b[i:]); i += n
        case 1:
            i += 8
        case 2:
            l, n := binary.Uvarint(b[i:]); if n <= 0 { return false }; i += n + int(l)
        case 5:
            i += 4
        default:
            return false
        }
        if i > len(b) { return false }
    }
    return true
}

Type guard

func isProtoUnmarshalWireTypeError(err error) bool {
    return err != nil && strings.Contains(err.Error(), "wrong wireType = ")
}

Try / catch

var req pb.SomeRequest
if err := proto.Unmarshal(blob, &req); err != nil {
    if isProtoUnmarshalWireTypeError(err) {
        return trace.BadParameter("payload incompatible with current schema; upgrade peer")
    }
    return trace.Wrap(err)
}

Prevention

When it happens

Trigger: Calling Unmarshal (directly or via gRPC/transport deserialization) on bytes where field 7 of the target message (containing SSOClientRedirectURL, e.g. a PingRequest/AuthPreference-derived message) is encoded with a non-length-delimited wire type (varint 0, fixed64 1, fixed32 5, or group 3/4).

Common situations: Client and server built from different proto schema versions (field 7 renumbered or changed type); corrupted or truncated buffers; hand-crafted test fixtures; a proxy or middleware mangling binary frames; sending JSON/other encoding into a proto unmarshal path.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/8a4ebc9101800c6f. Report an issue: GitHub.