JuliusBrussee/caveman · error

provider %q upstream URL path rejected: %w

Error message

provider %q upstream URL path rejected: %w

What it means

The path portion of the named provider's upstream URL failed the shared path-component hardening (backslash, empty interior segment, dot segment, or ambiguous %2f/%5c/%2e escape). The wrapped error names the exact violation; this guards against route-identity changes across proxy hops.

Source

Thrown at proxy/providers/openaicompat/openaicompat.go:357

	}
	u, err := url.Parse(strings.TrimSpace(raw))
	if err != nil {
		return nil, err
	}
	if u.Scheme != "http" && u.Scheme != "https" {
		return nil, fmt.Errorf("provider %q upstream URL scheme %q is not allowed", provider, u.Scheme)
	}
	if !u.IsAbs() || u.Host == "" || u.Hostname() == "" {
		return nil, fmt.Errorf("provider %q upstream URL must be an absolute URL with a host", provider)
	}
	if u.User != nil {
		return nil, fmt.Errorf("provider %q upstream URL must not include userinfo", provider)
	}
	if u.Fragment != "" {
		return nil, fmt.Errorf("provider %q upstream URL must not include a fragment", provider)
	}
	if err := validatePathComponents(u.Path, u.RawPath); err != nil {
		return nil, fmt.Errorf("provider %q upstream URL path rejected: %w", provider, err)
	}
	return u, nil
}

View on GitHub (pinned to 5184b3d11a)

Solutions

1. Remove backslashes, double slashes, and . / .. segments from the configured base_url path
2. Percent-encode legitimate special characters instead of leaving raw %2f, %5c, or %2e sequences in the path
3. Simplify the base_url to host plus optional clean path prefix, moving route logic to config fields

When it happens

Trigger: Thrown at proxy/providers/openaicompat/openaicompat.go:314 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@5184b3d11a (2026-08-18). Data as JSON: /api/errors/b0b727b79e2a1bac. Report an issue: GitHub.