{"record":{"id":"27849a4c1a45d12d","repo":"larksuite/cli","slug":"proxy-address-is-empty","errorCode":null,"errorMessage":"proxy address is empty","messagePattern":"proxy address is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sidecar/protocol.go","lineNumber":140,"sourceCode":"//\n// Host must be loopback or in sameHostAliases. The sidecar pattern is\n// inherently same-machine; cross-machine deployment is a different product\n// and is not supported by this feature.\n//\n// https:// is rejected because sidecar is a same-host pattern: loopback\n// and virtual same-host bridges don't traverse any untrusted medium, so\n// TLS adds no security. Cross-machine deployment is out of scope (see the\n// host constraint above), so there is no scenario today where https\n// provides a real benefit over http on loopback.\n//\n// userinfo (user:pass@) is rejected unconditionally — the sidecar protocol\n// does not use basic auth, and the syntactic slot exists only as a phishing\n// vector (e.g. http://127.0.0.1@attacker.com).\n//\n// Returns an error if the value is not a valid proxy address.\nfunc ValidateProxyAddr(addr string) error {\n\tif addr == \"\" {\n\t\treturn fmt.Errorf(\"proxy address is empty\")\n\t}\n\n\t// Bare host:port (no scheme) — validate as a net address.\n\tif !strings.Contains(addr, \"://\") {\n\t\thost, port, err := net.SplitHostPort(addr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: expected host:port or http://host:port\", addr)\n\t\t}\n\t\tif host == \"\" || port == \"\" {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: host and port must not be empty\", addr)\n\t\t}\n\t\tif !isSameHost(host) {\n\t\t\treturn errNotSameHost(addr)\n\t\t}\n\t\treturn nil\n\t}\n\n\tu, err := url.Parse(addr)","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/sidecar/protocol.go#L122-L158","documentation":"ValidateProxyAddr rejects an empty LARKSUITE_CLI_AUTH_PROXY value with 'proxy address is empty'. The sidecar proxy address was configured as an empty string, so there is no address to validate or connect to.","triggerScenarios":"ValidateProxyAddr(\"\") is invoked from ResolveAccount, ResolveInterceptor, or package init when LARKSUITE_CLI_AUTH_PROXY is set but empty (e.g. `export LARKSUITE_CLI_AUTH_PROXY=` or an empty value in a config file/env template), where code treats 'set' as 'use proxy' but the value carries no address.","commonSituations":"Exporting the variable with no value in a shell profile; CI/CD secret configured as empty; config file with `auth_proxy = \"\"`; a templating step that substituted a missing variable with an empty string.","solutions":["Set the variable to a real address, e.g. `export LARKSUITE_CLI_AUTH_PROXY=\"127.0.0.1:16384\"` or `http://127.0.0.1:16384` (DefaultListenAddr).","If you do not want the sidecar at all, unset the variable entirely (`unset LARKSUITE_CLI_AUTH_PROXY`) rather than setting it empty, so the proxy path is disabled instead of misconfigured.","Check your shell profile / dotenv / CI secret for a definition that sets it to the empty string.","Confirm the sidecar process is actually started and note its listen address, then use that address."],"exampleFix":"# before\nexport LARKSUITE_CLI_AUTH_PROXY=\n# after\nexport LARKSUITE_CLI_AUTH_PROXY=\"127.0.0.1:16384\"\n# or, to disable:\nunset LARKSUITE_CLI_AUTH_PROXY","handlingStrategy":"validation","validationCode":"addr := os.Getenv(\"LARKSUITE_CLI_AUTH_PROXY\")\nif strings.TrimSpace(addr) == \"\" {\n\treturn errors.New(\"LARKSUITE_CLI_AUTH_PROXY is empty; set it (e.g. 127.0.0.1:16384) or unset it to disable the sidecar\")\n}\nif err := sidecar.ValidateProxyAddr(addr); err != nil {\n\treturn err\n}","typeGuard":"func proxyAddrPresent() bool {\n\treturn strings.TrimSpace(os.Getenv(\"LARKSUITE_CLI_AUTH_PROXY\")) != \"\"\n}","tryCatchPattern":"if err := sidecar.ValidateProxyAddr(addr); err != nil {\n\tif err.Error() == \"proxy address is empty\" {\n\t\treturn fmt.Errorf(\"sidecar enabled but no address given; set LARKSUITE_CLI_AUTH_PROXY=http://127.0.0.1:16384 or unset it\")\n\t}\n\treturn err\n}","preventionTips":["Unset the variable entirely to disable the sidecar; an empty value is not 'off'.","Audit shell profiles, dotenv files, and CI secrets for empty assignments.","In deploy templates, fail fast when a required substitution is missing instead of emitting an empty string.","Validate with sidecar.ValidateProxyAddr at startup, before the first API call."],"tags":["configuration","env-var","sidecar","proxy-address"],"backgroundTag":"missing-env-var","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}