Pumpkin-MC/Pumpkin · error · TextureError

Invalid URL scheme for player texture

Error message

Invalid URL scheme for player texture: {0}

What it means

Thrown while resolving a Minecraft player skin/cape texture when the texture URL's scheme (e.g. http, ftp) is not http/https. Wraps the offending scheme string; indicates a malformed or hostile profile property, not a network failure.

Solutions

1. Reject the texture property and fall back to the default skin
2. Log the scheme at debug level and continue login without the custom texture
3. Only accept http/https schemes before any URL fetch

When it happens

Trigger: Thrown at crates/pumpkin/src/net/authentication.rs:415 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/ba6ecdf05438435b. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin/src/net/authentication.rs:415

    #[error("Failed to verify username")]
    UnverifiedUsername,
    #[error("You are banned from Authentication servers")]
    Banned,
    #[error("Texture Error {0}")]
    TextureError(TextureError),
    #[error("You have disallowed actions from Authentication servers")]
    DisallowedAction,
    #[error("Failed to parse JSON into Game Profile")]
    FailedParse,
    #[error("Unknown Status Code {0}")]
    UnknownStatusCode(StatusCode),
}

#[derive(Error, Debug)]
pub enum TextureError {
    #[error("Invalid URL")]
    InvalidURL,
    #[error("Invalid URL scheme for player texture: {0}")]
    DisallowedUrlScheme(String),
    #[error("Invalid URL domain for player texture: {0}")]
    DisallowedUrlDomain(String),
    #[error("Failed to decode base64 player texture: {0}")]
    DecodeError(String),
    #[error("Failed to parse JSON from player texture: {0}")]
    JSONError(String),
}

#[cfg(test)]
mod tests {
    use super::ProfileTextures;

    // Third-party auth servers (drasl, Blessing Skin, littleskin.cn) don't send
    // `signatureRequired`. The profile must still parse. See issue #301.
    #[test]
    fn parses_profile_without_signature_required() {
        let json = r#"{

View on GitHub (pinned to 8d4639e25a)