goauthentik / goauthentik/authentik

Constant stacktraces "Unexpected ASGI message 'websocket.close', after sending 'websocket.close'."

Open
#21,550 2 comments 0 reactions 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### Describe the bug

```
{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "/-/health/live/", "host": "localhost:8000", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 43, "remote": "255.255.255.255", "request_id": "066906afc5a94c0681604303a1f3f5e1", "runtime": 15, "schema_name": "public", "scheme": "http", "status": 200, "timestamp": "2026-04-11T15:28:12.914626", "user": "", "user_agent": "goauthentik.io/router/healthcheck"}
{"auth_via": "secret_key", "domain_url": null, "event": "runtime error during accept", "exc": "RuntimeError(\"Expected ASGI message 'websocket.send' or 'websocket.close', but got 'websocket.accept'.\")", "level": "warning", "logger": "authentik.outposts.consumer", "outpost": "", "pid": 43, "schema_name": "public", "timestamp": "2026-04-11T15:28:13.595281"}
{"auth_via": "secret_key", "domain_url": null, "event": "Exception in ASGI application", "exc": "ClientDisconnected()", "level": "warning", "logger": "authentik.asgi", "pid": 43, "schema_name": "public", "timestamp": "2026-04-11T15:28:13.596887"}
Exception in ASGI application
Traceback (most recent call last):
File "/ak-root/.venv/lib/python3.14/site-packages/uvicorn/protocols/websockets/wsproto_impl.py", line 235, in run_asgi
result = await self.app(self.scope, self.receive, self.send) # type: ignore[func-returns-value]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/.venv/lib/python3.14/site-packages/uvicorn/middleware/proxy_headers.py", line 60, in __call__
return await self.app(scope, receive, send)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/.venv/lib/python3.14/site-packages/sentry_sdk/integrations/asgi.py", line 170, in _run_asgi3
return await self._run_app(scope, receive, send, asgi_version=3)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/.venv/lib/python3.14/site-packages/sentry_sdk/integrations/asgi.py", line 262, in _run_app
raise exc from None
File "/ak-root/.venv/lib/python3.14/site-packages/sentry_sdk/integrations/asgi.py", line 257, in _run_app
return await self.app(
^^^^^^^^^^^^^^^
scope, receive, _sentry_wrapped_send
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/ak-root/.venv/lib/python3.14/site-packages/channels/routing.py", line 48, in __call__
return await application(scope, receive, send)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/authentik/root/asgi.py", line 56, in __call__
return await self.app(scope, receive, send)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/.venv/lib/python3.14/site-packages/channels/routing.py", line 118, in __call__
return await application(
^^^^^^^^^^^^^^^^^^
...<10 lines>...
)
^
File "/ak-root/.venv/lib/python3.14/site-packages/channels/routing.py", line 118, in __call__
return await application(
^^^^^^^^^^^^^^^^^^
...<10 lines>...
)
^
File "/authentik/root/middleware.py", line 303, in __call__
return await send({"type": "websocket.close"})
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/.venv/lib/python3.14/site-packages/sentry_sdk/integrations/asgi.py", line 250, in _sentry_wrapped_send
return await send(event)
^^^^^^^^^^^^^^^^^
File "/ak-root/.venv/lib/python3.14/site-packages/uvicorn/protocols/websockets/wsproto_impl.py", line 368, in send
raise RuntimeError(msg % message_type)
RuntimeError: Unexpected ASGI message 'websocket.close', after sending 'websocket.close'.
{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "/-/health/live/", "host": "localhost:8000", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 42, "remote": "255.255.255.255", "request_id": "176676f470ff4569b52fbc94cc9d3a21", "runtime": 59, "schema_name": "public", "scheme": "http", "status": 200, "timestamp": "2026-04-11T15:28:22.988490", "user": "", "user_agent": "goauthentik.io/router/healthcheck"}
{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "/-/health/live/", "host": "localhost:8000", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 43, "remote": "255.255.255.255", "request_id": "0be0cb18fe594ca6a1392c433c332115", "runtime": 31, "schema_name": "public", "scheme": "http", "status": 200, "timestamp": "2026-04-11T15:28:32.981089", "user": "", "user_agent": "goauthentik.io/router/healthcheck"}
```

Generally the whole authenti server feels much slower now than before the update. the liveness probe takes over 3 seconds to respond on same hardware.

### How to reproduce

I dont know, I just updated my kubernetes helm chart to 2026.2.2 and then this started happening

### Expected behavior

No such errors in the log?

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Kubernetes

### Version

2026.2.2

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Research direction

Start with /authentik/root/middleware.py around line 303 and /authentik/root/asgi.py around line 56, then trace the websocket message lifecycle shown in the stack trace. Reproduce on Kubernetes with Helm chart version 2026.2.2 and compare liveness-probe latency. Done means the duplicate websocket-close errors are no longer logged and the reported slowdown is explained or resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, python
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.