{"record":{"id":"36b64afeb5904015","repo":"hasura/graphql-engine","slug":"invalid-url-for-auth-webhook-0","errorCode":null,"errorMessage":"Invalid URL for auth webhook: {0}","messagePattern":"Invalid URL for auth webhook: (.+?)","errorType":"error_code","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/crates/auth/hasura-authn/src/lib.rs","lineNumber":289,"sourceCode":"    InvalidHeaderName(String),\n    #[error(\"Header value '{0}' is not a valid header value for header '{1}' in the auth config\")]\n    InvalidHeaderValue(String, String),\n}\n\nimpl Warning {\n    pub fn should_be_an_error(&self, flags: &open_dds::flags::OpenDdFlags) -> bool {\n        match self {\n            Warning::InvalidHeaderName(_) | Warning::InvalidHeaderValue(_, _) => {\n                flags.contains(open_dds::flags::Flag::DisallowInvalidHeadersInAuthConfig)\n            }\n            _ => false,\n        }\n    }\n}\n\n#[derive(Debug, thiserror::Error, PartialEq)]\npub enum Error {\n    #[error(\"Invalid URL for auth webhook: {0}\")]\n    InvalidAuthWebhookUrl(String),\n    #[error(\"{0}\")]\n    AuthConfigWarningsAsErrors(SeparatedBy<Warning>),\n    #[error(\"Duplicate alternative mode identifier: '{0}'\")]\n    DuplicateAlternativeModeIdentifier(String),\n}\n\n// A small utility type which exists for the sole purpose of displaying a vector with a certain\n// separator.\n#[derive(Debug, PartialEq)]\npub struct SeparatedBy<T> {\n    pub lines_of: Vec<T>,\n    pub separator: String,\n}\n\nimpl<T: Display> Display for SeparatedBy<T> {\n    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n        for (index, elem) in self.lines_of.iter().enumerate() {","sourceCodeStart":271,"sourceCodeEnd":307,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/auth/hasura-authn/src/lib.rs#L271-L307","documentation":"A hard error from auth config generation: the configured authentication webhook URL cannot be parsed as a valid URL. The webhook is the endpoint the engine calls to authenticate requests, so an unparseable URL aborts the build.","triggerScenarios":"The `webhook` field of the auth config contains a string that fails standard URL parsing (missing scheme, embedded spaces, malformed percent-encoding, etc.).","commonSituations":"Missing https:// prefix, trailing whitespace or template placeholders left unreplaced, using a service name without a scheme in Kubernetes-style configs, or typos introduced during config refactors.","solutions":["Fix the webhook URL to include scheme and host, e.g. https://auth.example.com/webhook","Check for stray whitespace, quotes, or unreplaced environment variables in the URL string","Verify the URL parses with a standard parser (e.g. `url::Url::parse`) before rebuilding"],"exampleFix":"// before\nwebhook: { url: \"auth.example.com/webhook\" }\n// after\nwebhook: { url: \"https://auth.example.com/webhook\" }","handlingStrategy":"validation","validationCode":"use url::Url;\nlet webhook_url = Url::parse(&auth_config.webhook.url)\n    .map_err(|e| format!(\"invalid auth webhook URL: {e}\"))?;\nif !matches!(webhook_url.scheme(), \"http\" | \"https\") {\n    return Err(\"webhook URL must be http(s)\".into());\n}","typeGuard":"fn isWebhookUrlValid(u: &str) -> bool { url::Url::parse(u).map(|x| x.has_host()).unwrap_or(false) }","tryCatchPattern":"match build_auth_config(&metadata) {\n    Err(Error::InvalidAuthWebhookUrl(bad)) => fail_deploy_with_context(\"fix webhook URL\", bad),\n    r => r,\n}","preventionTips":["Always include scheme and host in webhook URLs","Envsubst and lint webhook URLs in CI","Reject configs whose webhook URL fails Url::parse"],"tags":["auth","webhook","url-parsing","config-validation"],"backgroundTag":"invalid-url-format","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}