oauth2-proxy/oauth2-proxy · error

error performing request: %v

Error message

error performing request: %v

What it means

The requests builder wraps any error returned by DefaultHTTPClient.Do(req) when the HTTP request is actually performed. This is a transport-level failure: DNS resolution, TCP connect, TLS handshake, timeouts, or the request context being cancelled — the server may not even be reachable. The wrapped error contains the underlying net/http cause.

Source

Thrown at pkg/requests/builder.go:104

		r.context = context.Background()
	}

	return r.do()
}

// do creates the request, executes it with the default client and extracts the
// the body into the response
func (r *builder) do() Result {
	req, err := http.NewRequestWithContext(r.context, r.method, r.endpoint, r.body)
	if err != nil {
		r.result = &result{err: fmt.Errorf("error creating request: %v", err)}
		return r.result
	}
	req.Header = r.header

	resp, err := DefaultHTTPClient.Do(req)
	if err != nil {
		r.result = &result{err: fmt.Errorf("error performing request: %v", err)}
		return r.result
	}

	defer resp.Body.Close()
	body, err := io.ReadAll(resp.Body)
	if err != nil {
		r.result = &result{err: fmt.Errorf("error reading response body: %v", err)}
		return r.result
	}

	r.result = &result{response: resp, body: body}
	return r.result
}

View on GitHub (pinned to 33c2eb92de)

Solutions

1. Read the wrapped error to distinguish DNS failure, connection refused, TLS error, or context deadline
2. Verify the endpoint host/port is reachable (curl / getent hosts) from the proxy's environment
3. Check the context timeout passed to the builder — increase it if the upstream is slow
4. Fix the CA bundle / certificate chain if the cause is a TLS verification error, and add retry logic for transient network failures

// Pre-flight reachability check
conn, err := net.DialTimeout("tcp", host, 5*time.Second)
if err != nil {
    return fmt.Errorf("upstream %s unreachable: %w", host, err)
}
conn.Close()

res := requests.New(ctx).WithMethod("GET").WithEndpoint(u).Do()
if res.Error() != nil {
    var netErr net.Error
    if errors.As(res.Error(), &netErr) && netErr.Timeout() {
        // retry with backoff or extend the context deadline
    }
    return res.Error()
}

When it happens

Trigger: Calling Do() on a request builder when the target host does not resolve or is unreachable, the TLS certificate is invalid, the context deadline (WithCancel/Timeout) expires mid-request, or the connection is reset before a response arrives.

Common situations: Misconfigured provider hostname/port in oauth2-proxy config; calling internal endpoints from an environment without network access; upstream TLS certificates not trusted by the container's CA bundle; context timeouts too short for slow upstreams.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• failed to fetch claims from profile URL: %v
• error reading response body: %v
• failed to retrieve user info: %v
• error getting user info: %v
• http.Hijacker is not available on writer

AI-assisted analysis of oauth2-proxy/oauth2-proxy@33c2eb92de (2026-09-06). Data as JSON: /api/errors/f5048ca97b57ec87. Report an issue: GitHub.