From 95fb896a03dde104ff625e19a76bb7388f36ad7a Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 7 Jan 2026 17:56:07 +0000 Subject: [PATCH] fix: Agent 405 errors when reverse proxy redirects HTTP to HTTPS When a user's reverse proxy redirects HTTP to HTTPS, Go's default HTTP client behavior converts POST requests to GET on 301/302 redirects (per HTTP specification). This causes the Pulse server to return 405 "Only POST is allowed" errors. Added CheckRedirect to all agent HTTP clients (host, docker, kubernetes) that returns a clear error message guiding users to use the correct protocol in their --url flag instead of silently following redirects. Related to #1058 --- internal/dockeragent/agent.go | 6 ++++++ internal/hostagent/agent.go | 6 ++++++ internal/kubernetesagent/agent.go | 6 ++++++ 3 files changed, 18 insertions(+) diff --git a/internal/dockeragent/agent.go b/internal/dockeragent/agent.go index e7f741ba4..bac94cab9 100644 --- a/internal/dockeragent/agent.go +++ b/internal/dockeragent/agent.go @@ -999,6 +999,12 @@ func newHTTPClient(insecure bool) *http.Client { Transport: &http.Transport{ TLSClientConfig: tlsConfig, }, + // Disallow redirects for agent API calls. If a reverse proxy redirects + // HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec), + // causing 405 errors. Return an error with guidance instead. + CheckRedirect: func(req *http.Request, via []*http.Request) error { + return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL) + }, } } diff --git a/internal/hostagent/agent.go b/internal/hostagent/agent.go index d3ccc0a33..502503bb2 100644 --- a/internal/hostagent/agent.go +++ b/internal/hostagent/agent.go @@ -184,6 +184,12 @@ func New(cfg Config) (*Agent, error) { Proxy: http.ProxyFromEnvironment, TLSClientConfig: tlsConfig, }, + // Disallow redirects for agent API calls. If a reverse proxy redirects + // HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec), + // causing 405 errors. Return an error with guidance instead. + CheckRedirect: func(req *http.Request, via []*http.Request) error { + return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL) + }, } trimmedTags := make([]string, 0, len(cfg.Tags)) diff --git a/internal/kubernetesagent/agent.go b/internal/kubernetesagent/agent.go index 6d771e636..2c16795db 100644 --- a/internal/kubernetesagent/agent.go +++ b/internal/kubernetesagent/agent.go @@ -139,6 +139,12 @@ func New(cfg Config) (*Agent, error) { Proxy: http.ProxyFromEnvironment, TLSClientConfig: tlsConfig, }, + // Disallow redirects for agent API calls. If a reverse proxy redirects + // HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec), + // causing 405 errors. Return an error with guidance instead. + CheckRedirect: func(req *http.Request, via []*http.Request) error { + return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL) + }, } clusterServer := strings.TrimSpace(restCfg.Host)