apache/shenyu · error · IllegalArgumentException

Host cannot be empty

Error message

Host cannot be empty

What it means

validateHostForSSRF is the host-level guard invoked (directly or via validateUrlForSSRF) before admin issues an outbound request. A null or blank host throws IllegalArgumentException "Host cannot be empty" since SSRF checks cannot proceed without a host to evaluate.

Solutions

1. Supply the actual hostname or IP of the target as the host argument.
2. Fix the source config so the address includes a host, not just a port or path.
3. Ensure callers pass parsedUrl.host() from a successfully parsed HttpUrl rather than raw substrings.
4. Catch IllegalArgumentException and report 'target host is required' to the user.

Example fix

// before
validateHostForSSRF(uri.getHost(), uri.getPort()); // getHost() may be null
// after
HttpUrl url = HttpUrl.parse(targetUrl);
if (url != null && !url.host().isEmpty()) {
    validateHostForSSRF(url.host(), url.port());
}

HttpUrl parsed = HttpUrl.parse(url);
if (parsed == null || parsed.host().trim().isEmpty()) {
    throw new IllegalArgumentException("Target URL must include a host, e.g. http://backend:8080");
}

boolean hasHost(String s) {
    HttpUrl u = s == null ? null : HttpUrl.parse(s.trim());
    return u != null && !u.host().trim().isEmpty();
}

try {
    UrlSecurityUtils.validateHostForSSRF(host, port);
} catch (IllegalArgumentException e) {
    return ResponseEntity.badRequest().body("Target host is required");
}

When it happens

Trigger: Calling validateHostForSSRF(null, port) or with an empty/blank host string; also reachable from validateUrlForSSRF when a parsed URL somehow yields an empty host (rare, e.g. odd scheme-less inputs).

Common situations: Configured target addresses missing the host portion (e.g. just ':8080' or '/path'); programmatic callers assembling host/port from incomplete config or request parameters.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• URL cannot be empty
• Invalid URL format
• Only HTTP and HTTPS protocols are allowed
• Access to localhost is not allowed
• Access to private or internal IP addresses is not allowed

AI-assisted analysis of apache/shenyu@567142e072 (2026-09-12). Data as JSON: /api/errors/48be55f9333553a2. Report an issue: GitHub.

Appendix: source

Thrown at shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java:80

        // Only allow HTTP and HTTPS protocols
        if (!HTTP_PROTOCOL.equals(protocol) && !HTTPS_PROTOCOL.equals(protocol)) {
            throw new IllegalArgumentException("Only HTTP and HTTPS protocols are allowed");
        }

        // Validate host for SSRF protection using the same URL parser as request execution.
        validateHostForSSRF(parsedUrl.host(), parsedUrl.port());
    }

    /**
     * Validate host to prevent SSRF attacks.
     *
     * @param host the host to validate
     * @param port the port to validate
     * @throws IllegalArgumentException if the host is not allowed
     */
    public static void validateHostForSSRF(final String host, final int port) {
        if (Objects.isNull(host) || host.trim().isEmpty()) {
            throw new IllegalArgumentException("Host cannot be empty");
        }

        String normalizedHost = host.toLowerCase().trim();

        // Check for localhost variations
        if (isLocalhost(normalizedHost)) {
            throw new IllegalArgumentException("Access to localhost is not allowed");
        }

        // Check for private IP addresses
        if (isPrivateOrInternalIP(normalizedHost)) {
            throw new IllegalArgumentException("Access to private or internal IP addresses is not allowed");
        }

        // Check for sensitive ports
        if (isSensitivePort(port)) {
            throw new IllegalArgumentException("Access to sensitive ports is not allowed");
        }

View on GitHub (pinned to 567142e072)