{"record":{"id":"0d2862f2b43cf716","repo":"cloudflare/cloudflared","slug":"invalid-host-provided","errorCode":null,"errorMessage":"invalid Host provided","messagePattern":"invalid Host provided","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/access/validation.go","lineNumber":71,"sourceCode":"\t\tinput = fmt.Sprintf(\"https://%s\", input)\n\t}\n\tinput = bracketBareIPv6(input)\n\turl, err := url.ParseRequestURI(input)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse as URL: %w\", err)\n\t}\n\tif url.Scheme != \"https\" {\n\t\turl.Scheme = \"https\"\n\t}\n\tif url.Host == \"\" {\n\t\treturn nil, errors.New(\"failed to parse Host\")\n\t}\n\thost, err := httpguts.PunycodeHostPort(url.Host)\n\tif err != nil || host == \"\" {\n\t\treturn nil, err\n\t}\n\tif !httpguts.ValidHostHeader(host) {\n\t\treturn nil, errors.New(\"invalid Host provided\")\n\t}\n\turl.Host = host\n\treturn url, nil\n}\n","sourceCodeStart":53,"sourceCodeEnd":76,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/access/validation.go#L53-L76","documentation":"parseURL validates the host with httpguts.ValidHostHeader after Punycode conversion. If the host contains characters that are not legal in an HTTP Host header (spaces, control characters, invalid unicode, forbidden symbols), this error is returned. The URL parsed but its hostname cannot be used as a valid Access origin host.","triggerScenarios":"Passing hosts with spaces, commas, control characters, or invalid IDN input that PunycodeHostPort cannot convert — e.g. `cloudflared access ssh \"my app.example.com\"` or hosts with underscores/odd symbols depending on validation rules.","commonSituations":"Copy-pasted URLs with trailing spaces or invisible characters; misconfigured DNS names with illegal characters; non-ASCII hostnames that fail punycode conversion.","solutions":["Remove illegal characters (spaces, control chars) from the hostname.","Use punycode (xn--) form for internationalized hostnames if plain unicode fails.","Trim whitespace: `TARGET=$(echo \"$TARGET\" | tr -d '[:space:]')` before invoking.","Confirm the application hostname in Zero Trust matches what you pass."],"exampleFix":"# before\ncloudflared access ssh \"my app.example.com\"\n# after\ncloudflared access ssh \"my-app.example.com\"","handlingStrategy":"validation","validationCode":"import \"golang.org/x/net/idna\"\nfunc validHost(h string) bool {\n    h = strings.TrimSpace(h)\n    if h == \"\" || strings.ContainsAny(h, \" \\t\\r\\n\") { return false }\n    _, err := idna.Lookup.ToASCII(h)\n    return err == nil\n}","typeGuard":null,"tryCatchPattern":"url, err := parseURL(raw)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid Host provided\") {\n        return fmt.Errorf(\"hostname %q contains characters invalid for a Host header\", raw)\n    }\n    return err\n}","preventionTips":["Trim whitespace from pasted hostnames before use.","Convert internationalized names to punycode (xn--...) ahead of time.","Avoid underscores and symbols in hostnames; stick to letters, digits, hyphens, dots."],"tags":["cli","url","validation","hostname"],"backgroundTag":"invalid-url-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}