oauth2-proxy/oauth2-proxy · error

unable to get ip and port from http.RemoteAddr (%s)

Error message

unable to get ip and port from http.RemoteAddr (%s)

What it means

Parse failure in getRemoteIP: req.RemoteAddr is not in host:port form (and is not the "@" unix-socket sentinel), so the transport-level peer address cannot be turned into a net.IP. Typically caused by a custom listener or test harness producing a non-standard RemoteAddr.

Source

Thrown at pkg/ip/realclientip.go:84

// GetClientIP obtains the perceived end-user IP address from headers if p != nil else from req.RemoteAddr.
func GetClientIP(p ipapi.RealClientIPParser, req *http.Request) (net.IP, error) {
	if p != nil {
		return p.GetRealClientIP(req.Header)
	}
	return getRemoteIP(req)
}

// getRemoteIP obtains the IP of the low-level connected network host
func getRemoteIP(req *http.Request) (net.IP, error) {
	// Unix domain sockets set RemoteAddr to "@" which has no meaningful IP.
	// https://github.com/golang/go/blob/0fa53e41f122b1661d0678a6d36d71b7b5ad031d/src/syscall/syscall_linux.go#L506-L511
	if req.RemoteAddr == "@" {
		return nil, nil
	}

	//revive:disable:indent-error-flow
	if ipStr, _, err := net.SplitHostPort(req.RemoteAddr); err != nil {
		return nil, fmt.Errorf("unable to get ip and port from http.RemoteAddr (%s)", req.RemoteAddr)
	} else if ip := net.ParseIP(ipStr); ip != nil {
		return ip, nil
	} else {
		return nil, fmt.Errorf("unable to parse ip (%s)", ipStr)
	}
	//revive:enable:indent-error-flow
}

// GetClientString obtains the human readable string of the remote IP and optionally the real client IP if available
func GetClientString(p ipapi.RealClientIPParser, req *http.Request, full bool) (s string) {
	var realClientIPStr string
	if p != nil {
		if realClientIP, err := p.GetRealClientIP(req.Header); err == nil && realClientIP != nil {
			realClientIPStr = realClientIP.String()
		}
	}

	var remoteIPStr string

View on GitHub (pinned to 33c2eb92de)

Solutions

1. Ensure the server is reached over TCP so RemoteAddr is host:port
2. For unix sockets the "@" case is already handled; fix custom listeners to set a parseable RemoteAddr
3. In tests, use httptest or set RemoteAddr to a valid host:port

When it happens

Trigger: Thrown at pkg/ip/realclientip.go:84 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of oauth2-proxy/oauth2-proxy@33c2eb92de (2026-09-06). Data as JSON: /api/errors/49fdd602963aa74f. Report an issue: GitHub.