{"record":{"id":"13703800bb7b851b","repo":"github/github-mcp-server","slug":"failed-to-create-default-api-host-w","errorCode":null,"errorMessage":"failed to create default API host: %w","messagePattern":"failed to create default API host: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/http/oauth/oauth.go","lineNumber":85,"sourceCode":"}\n\n// AuthHandler handles OAuth-related HTTP endpoints.\ntype AuthHandler struct {\n\tcfg     *Config\n\tapiHost utils.APIHostResolver\n}\n\n// NewAuthHandler creates a new OAuth auth handler.\nfunc NewAuthHandler(cfg *Config, apiHost utils.APIHostResolver) (*AuthHandler, error) {\n\tif cfg == nil {\n\t\tcfg = &Config{}\n\t}\n\n\tif apiHost == nil {\n\t\tvar err error\n\t\tapiHost, err = utils.NewAPIHost(\"https://api.github.com\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create default API host: %w\", err)\n\t\t}\n\t}\n\n\treturn &AuthHandler{\n\t\tcfg:     cfg,\n\t\tapiHost: apiHost,\n\t}, nil\n}\n\n// routePatterns defines the route patterns for OAuth protected resource metadata.\nvar routePatterns = []string{\n\t\"\",          // Root: /.well-known/oauth-protected-resource\n\t\"/readonly\", // Read-only mode\n\t\"/insiders\", // Insiders mode\n\t\"/x/{toolset}\",\n\t\"/x/{toolset}/readonly\",\n}\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/http/oauth/oauth.go#L67-L103","documentation":"NewAuthHandler, when called with a nil apiHost resolver, falls back to utils.NewAPIHost(\"https://api.github.com\") and that constant failed URL parsing/normalization. With the shipped constant this path is practically unreachable; it fires in forks or custom builds that change the default host string.","triggerScenarios":"Passing nil as apiHost in a build where the default constant was edited to an invalid URL; defensive URL validation rejecting a modified host.","commonSituations":"Forks pointing the default at an internal gateway with a malformed URL; refactors of the default constant.","solutions":["Pass an explicit apiHost resolver to NewAuthHandler instead of relying on the default","Keep any customized default an absolute https URL","Add a unit test asserting NewAuthHandler with a nil resolver succeeds"],"exampleFix":"// before\noauthHandler, err := oauth.NewAuthHandler(cfg, nil)\n\n// after - reuse the host already parsed and validated at startup\noauthHandler, err := oauth.NewAuthHandler(cfg, apiHost)","handlingStrategy":"validation","validationCode":"if apiHost == nil {\n\treturn nil, fmt.Errorf(\"apiHost resolver is required; construct one with utils.NewAPIHost first\")\n}\noauthHandler, err := oauth.NewAuthHandler(cfg, apiHost)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass an explicit, pre-validated apiHost resolver","Never rely on package-level default host constants in forks","Cover NewAuthHandler construction in startup smoke tests"],"tags":["configuration","oauth","url-parsing"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}