{"record":{"id":"28deacf2d072b282","repo":"cloudflare/cloudflared","slug":"failed-to-create-app-info-request","errorCode":null,"errorMessage":"failed to create app info request","messagePattern":"failed to create app info request","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":489,"sourceCode":"\t\tAppAUD:      claims.AUD,\n\t\tAppHostname: appHostname,\n\t}, nil\n}\n\n// fetchMetadataJWT sends a HEAD request to reqURL with the metadata request\n// header and returns the raw JWT string from the response. No redirects are\n// followed.\nfunc fetchMetadataJWT(reqURL string) (string, error) {\n\tclient := &http.Client{\n\t\tCheckRedirect: func(_ *http.Request, _ []*http.Request) error {\n\t\t\treturn http.ErrUseLastResponse\n\t\t},\n\t\tTimeout: time.Second * 7,\n\t}\n\n\treq, err := http.NewRequest(\"HEAD\", reqURL, nil)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to create app info request\")\n\t}\n\treq.Header.Set(accessMetadataReqHeader, accessMetadataReqValue)\n\treq.Header.Set(userAgentHeader, userAgent)\n\n\tresp, err := client.Do(req) // nolint: gosec\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to get app info\")\n\t}\n\t_ = resp.Body.Close()\n\n\trawJWT := resp.Header.Get(accessMetadataRespHeader)\n\tif rawJWT == \"\" {\n\t\treturn \"\", fmt.Errorf(\"failed to find Access application at %s\", reqURL)\n\t}\n\treturn rawJWT, nil\n}\n\nfunc validateMetadataIssuedAt(iat int64, now time.Time) error {","sourceCodeStart":471,"sourceCodeEnd":507,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L471-L507","documentation":"This error wraps a failure from http.NewRequest(\"HEAD\", reqURL, nil) inside fetchMetadataJWT, used by GetAppInfo to discover the Access application protecting a URL. http.NewRequest only fails on malformed input — an unparseable URL or invalid method — so this indicates the caller-supplied reqURL is not a valid URL. The error carries the underlying url.Parse failure.","triggerScenarios":"GetAppInfo / fetchMetadataJWT is called with a reqURL that fails url parsing — e.g. missing scheme (\"example.com\" instead of \"https://example.com\"), control characters in the URL, or a completely malformed string passed from CLI flags or config.","commonSituations":"User passes a hostname without https:// to cloudflared access, whitespace or stray characters in a configured URL, or programmatically constructed URLs missing the scheme component.","solutions":["Ensure reqURL includes an absolute scheme, e.g. https://app.example.com, not app.example.com","Trim whitespace/control characters from the URL before calling GetAppInfo","Validate with net/url.ParseRequestURI in caller code before invoking","If building from user input, URL-encode path/query components"],"exampleFix":"// before: passing a bare hostname\ninfo, err := token.GetAppInfo(ctx, \"app.example.com\", log)\n// after\nreqURL := \"app.example.com\"\nif _, err := url.ParseRequestURI(\"https://\" + strings.TrimPrefix(reqURL, \"https://\")); err == nil {\n\tinfo, err = token.GetAppInfo(ctx, \"https://\"+reqURL, log)\n}","handlingStrategy":"validation","validationCode":"u, err := url.ParseRequestURI(reqURL)\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n\treturn fmt.Errorf(\"invalid app URL %q: must be absolute (https://host)\", reqURL)\n}","typeGuard":null,"tryCatchPattern":"appInfo, err := GetAppInfo(ctx, reqURL, log)\nif err != nil && strings.Contains(err.Error(), \"failed to create app info request\") {\n\t// reqURL was malformed; fix input before retry\n}","preventionTips":["Always pass absolute URLs including https:// scheme","Trim whitespace from user-supplied URLs","Validate URLs with url.ParseRequestURI before use","Avoid string-concatenating URLs from untrusted config"],"tags":["http","url","validation"],"backgroundTag":"invalid-url-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}