{"record":{"id":"054eadbf813b8848","repo":"tursodatabase/turso","slug":"remote-turso-urls-must-not-include-embedded-user-i","errorCode":null,"errorMessage":"Remote Turso URLs must not include embedded user information; use Auth Token instead.","messagePattern":"Remote Turso URLs must not include embedded user information; use Auth Token instead\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"bindings/dotnet/src/Turso.Data/TursoConnectionOptions.cs","lineNumber":136,"sourceCode":"                \"Remote Encryption Cipher and Remote Encryption Key must be specified together.\");\n        }\n\n        return new TursoRemoteEncryptionOptions\n        {\n            Cipher = TursoRemoteEncryptionOptions.ParseCipher(cipher),\n            Key = key,\n        };\n    }\n\n    public Uri GetRemoteUri()\n    {\n        if (!Uri.TryCreate(DataSource, UriKind.Absolute, out var uri) || !IsRemoteScheme(uri.Scheme))\n            throw new InvalidOperationException($\"Data Source is not a remote Turso URL: {DataSource}\");\n\n        if (!string.IsNullOrEmpty(uri.Query) || !string.IsNullOrEmpty(uri.Fragment))\n            throw new InvalidOperationException(\"Remote Turso URLs must not include query strings or fragments.\");\n        if (!string.IsNullOrEmpty(uri.UserInfo))\n            throw new InvalidOperationException(\"Remote Turso URLs must not include embedded user information; use Auth Token instead.\");\n        if (string.IsNullOrEmpty(uri.Host))\n            throw new InvalidOperationException(\"Remote Turso URLs must include a host.\");\n\n        var scheme = uri.Scheme.ToLowerInvariant() switch\n        {\n            \"libsql\" => Tls == false ? \"http\" : \"https\",\n            \"turso\" => ValidateTls(uri.Scheme, expectedTls: true, normalizedScheme: \"https\"),\n            \"http\" => ValidateTls(uri.Scheme, expectedTls: false),\n            \"https\" => ValidateTls(uri.Scheme, expectedTls: true),\n            \"ws\" => ValidateTls(uri.Scheme, expectedTls: false, normalizedScheme: \"http\"),\n            \"wss\" => ValidateTls(uri.Scheme, expectedTls: true, normalizedScheme: \"https\"),\n            _ => throw new InvalidOperationException($\"Unsupported remote Turso URL scheme: {uri.Scheme}\")\n        };\n\n        var builder = new UriBuilder(uri)\n        {\n            Scheme = scheme,\n            Port = uri.IsDefaultPort ? -1 : uri.Port,","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/tursodatabase/turso/blob/6c7252267988c76e632af00a671e4b9788dfae13/bindings/dotnet/src/Turso.Data/TursoConnectionOptions.cs#L118-L154","documentation":"GetRemoteUri() rejects remote URLs with embedded user information ('user:pass@host' or 'token@host'). The Turso .NET provider sends credentials exclusively through the Authorization Bearer header configured via the 'Auth Token' keyword, so userinfo in the URL is treated as a configuration mistake rather than being silently forwarded.","triggerScenarios":"Data Source set to 'https://eyJhbGci...@db.turso.io' or 'https://user:password@db.turso.io' and then TursoConnection.Open() is called — any of libsql/http/https/ws/wss URLs with non-empty uri.UserInfo throw.","commonSituations":"Copying the 'https://<token>@<host>' URL form supported by other libsql clients or MySQL-style 'user:pass@host' connection URLs; secret managers that emit userinfo-style DSNs; tutorials mixing libsql SDK conventions.","solutions":["Remove the userinfo portion from the URL, keeping only scheme://host/path.","Put the token in the 'Auth Token' connection keyword so it is sent as a Bearer header.","If the userinfo was a database username, delete it — Turso remote databases authenticate with a token only."],"exampleFix":"// before\nData Source=https://eyJhbGciOiJ...@my-db-my-org.turso.io;\n\n// after\nData Source=https://my-db-my-org.turso.io;Auth Token=eyJhbGciOiJ...;","handlingStrategy":"validation","validationCode":"if (Uri.TryCreate(dataSource, UriKind.Absolute, out var u) && !string.IsNullOrEmpty(u.UserInfo))\n    throw new ConfigurationException(\"Move URL credentials to the 'Auth Token' keyword.\");","typeGuard":null,"tryCatchPattern":"try { await conn.OpenAsync(ct); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"embedded user information\")) { /* extract token from userinfo and switch to Auth Token keyword */ }","preventionTips":["Store host and token in separate config keys, never a single userinfo-style URL.","Document the Bearer-header-only auth model for anyone porting libsql SDK examples."],"tags":["csharp","dotnet","connection-string","url-validation","credentials"],"backgroundTag":"credentials-in-url-rejected","analyzedSha":"6c7252267988c76e632af00a671e4b9788dfae13","analyzedAt":"2026-08-20T07:02:18.389Z","contentChangedAt":"2026-08-20T07:02:18.389Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}