Pumpkin-MC/Pumpkin · error · TextureError

Invalid URL domain for player texture

Error message

Invalid URL domain for player texture: {0}

What it means

Fired during texture property validation when the URL's host is not on Minecraft's allowed texture domains (textures.minecraft.net, etc.). The bad domain is carried in the payload; it guards against SSRF-style redirects to arbitrary hosts.

Solutions

1. Use the default skin when the domain is untrusted
2. Validate the host against Mojang's known texture domains before use
3. Log and skip the offending texture property

When it happens

Trigger: Thrown at crates/pumpkin/src/net/authentication.rs:417 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/65112147e4b0e85d. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin/src/net/authentication.rs:417

    #[error("You are banned from Authentication servers")]
    Banned,
    #[error("Texture Error {0}")]
    TextureError(TextureError),
    #[error("You have disallowed actions from Authentication servers")]
    DisallowedAction,
    #[error("Failed to parse JSON into Game Profile")]
    FailedParse,
    #[error("Unknown Status Code {0}")]
    UnknownStatusCode(StatusCode),
}

#[derive(Error, Debug)]
pub enum TextureError {
    #[error("Invalid URL")]
    InvalidURL,
    #[error("Invalid URL scheme for player texture: {0}")]
    DisallowedUrlScheme(String),
    #[error("Invalid URL domain for player texture: {0}")]
    DisallowedUrlDomain(String),
    #[error("Failed to decode base64 player texture: {0}")]
    DecodeError(String),
    #[error("Failed to parse JSON from player texture: {0}")]
    JSONError(String),
}

#[cfg(test)]
mod tests {
    use super::ProfileTextures;

    // Third-party auth servers (drasl, Blessing Skin, littleskin.cn) don't send
    // `signatureRequired`. The profile must still parse. See issue #301.
    #[test]
    fn parses_profile_without_signature_required() {
        let json = r#"{
            "timestamp": 0,
            "profileId": "069a79f444e94726a5befca90e38aaf5",

View on GitHub (pinned to 8d4639e25a)