{"record":{"id":"0fb8f46304b89b44","repo":"cloudflare/cloudflared","slug":"error-validating-origin-url","errorCode":null,"errorMessage":"error validating origin URL","messagePattern":"error validating origin URL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/access/carrier.go","lineNumber":31,"sourceCode":"\n\t\"github.com/cloudflare/cloudflared/carrier\"\n\t\"github.com/cloudflare/cloudflared/config\"\n\t\"github.com/cloudflare/cloudflared/logger\"\n\t\"github.com/cloudflare/cloudflared/stream\"\n\t\"github.com/cloudflare/cloudflared/validation\"\n)\n\nconst (\n\tLogFieldHost               = \"host\"\n\tcfAccessClientIDHeader     = \"Cf-Access-Client-Id\"\n\tcfAccessClientSecretHeader = \"Cf-Access-Client-Secret\"\n)\n\n// StartForwarder starts a client side websocket forward\nfunc StartForwarder(forwarder config.Forwarder, shutdown <-chan struct{}, log *zerolog.Logger) error {\n\tvalidURL, err := validation.ValidateUrl(forwarder.Listener)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"error validating origin URL\")\n\t}\n\n\t// get the headers from the config file and add to the request\n\theaders := make(http.Header)\n\tif forwarder.TokenClientID != \"\" {\n\t\theaders.Set(cfAccessClientIDHeader, forwarder.TokenClientID)\n\t}\n\n\tif forwarder.TokenSecret != \"\" {\n\t\theaders.Set(cfAccessClientSecretHeader, forwarder.TokenSecret)\n\t}\n\theaders.Set(\"User-Agent\", userAgent)\n\n\tcarrier.SetBastionDest(headers, forwarder.Destination)\n\n\toptions := &carrier.StartOptions{\n\t\tOriginURL: forwarder.URL,\n\t\tHeaders:   headers, //TODO: TUN-2688 support custom headers from config file","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/access/carrier.go#L13-L49","documentation":"carrier.StartForwarder validates the forward-configured listener/origin URL with validation.ValidateUrl before opening the websocket forwarder. \"error validating origin URL\" wraps that failure, meaning the URL string in the config (forwarder.Listener) is missing, malformed, or uses an unsupported scheme. Nothing is sent over the network; this is local configuration validation.","triggerScenarios":"Running `cloudflared access ws-forward` (or config forwarder entries) where the listener value is empty, lacks a scheme, has an invalid host/port, or is otherwise unparseable as a URL.","commonSituations":"Config file forwarder blocks with `listener: localhost:8080` (missing scheme) or typos like `htp://`; empty listener because the config section was misnamed; environment-specific overrides left blank.","solutions":["Ensure the listener includes a full scheme, e.g. `listener: ws://localhost:8080` or `http://127.0.0.1:8080`.","Run `cloudflared access tcp --help` / check docs for expected forwarder URL format and correct the config key name.","Test the URL with `url.Parse` semantics or curl to confirm it is well-formed before rerunning.","Check that the right config file is loaded (TUNNEL_CONFIG) so listener isn't empty."],"exampleFix":"// before (config.yml)\nforwarder:\n  listener: localhost:8080\n// after\nforwarder:\n  listener: ws://localhost:8080","handlingStrategy":"validation","validationCode":"u, err := url.Parse(forwarder.Listener)\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n\treturn fmt.Errorf(\"listener must be a full URL with scheme and host, got %q\", forwarder.Listener)\n}","typeGuard":null,"tryCatchPattern":"if err := carrier.StartForwarder(forwarder, shutdown, log); err != nil {\n\tlog.Err(err).Msgf(\"forwarder start failed: %+v\", err)\n\treturn err\n}","preventionTips":["Always include scheme and host in listener URLs (ws:// or http://)","Keep config keys consistent with docs so listener is not empty","Sanity-check URLs with url.Parse in tooling before deploy"],"tags":["url","validation","access"],"backgroundTag":"invalid-url-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}