tailscale/tailscale · error

reading AUM

Error message

reading AUM

What it means

serveTKACosignRecoveryAUM reads a serialized recovery AUM from the request body (limited to 1 MiB). This 400 fires when io.ReadAll on the body fails, usually a transport error, so the AUM bytes were not received.

Source

Thrown at ipn/localapi/tailnetlock.go:368

	}
	w.Header().Set("Content-Type", "application/octet-stream")
	w.Write(res.Serialize())
}

func (h *Handler) serveTKACosignRecoveryAUM(w http.ResponseWriter, r *http.Request) {
	if !h.PermitWrite {
		http.Error(w, "access denied", http.StatusForbidden)
		return
	}
	if r.Method != httpm.POST {
		http.Error(w, "use POST", http.StatusMethodNotAllowed)
		return
	}

	body := io.LimitReader(r.Body, 1024*1024)
	aumBytes, err := io.ReadAll(body)
	if err != nil {
		http.Error(w, "reading AUM", http.StatusBadRequest)
		return
	}
	var aum tka.AUM
	if err := aum.Unserialize(aumBytes); err != nil {
		http.Error(w, "decoding AUM", http.StatusBadRequest)
		return
	}

	res, err := h.b.TailnetLockCosignRecoveryAUM(&aum)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	w.Header().Set("Content-Type", "application/octet-stream")
	w.Write(res.Serialize())
}

func (h *Handler) serveTKASubmitRecoveryAUM(w http.ResponseWriter, r *http.Request) {

View on GitHub (pinned to 6e0912f979)

Solutions

1. Send a complete AUM in the request body.

When it happens

Trigger: Thrown at ipn/localapi/tailnetlock.go:368 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/8409d2cdd22cc181. Report an issue: GitHub.