{"record":{"id":"38f2fdd6be566221","repo":"larksuite/cli","slug":"invalid-proxy-address-q-userinfo-is-not-allowed","errorCode":null,"errorMessage":"invalid proxy address %q: userinfo is not allowed","messagePattern":"invalid proxy address %q: userinfo is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sidecar/protocol.go","lineNumber":163,"sourceCode":"\t\thost, port, err := net.SplitHostPort(addr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: expected host:port or http://host:port\", addr)\n\t\t}\n\t\tif host == \"\" || port == \"\" {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: host and port must not be empty\", addr)\n\t\t}\n\t\tif !isSameHost(host) {\n\t\t\treturn errNotSameHost(addr)\n\t\t}\n\t\treturn nil\n\t}\n\n\tu, err := url.Parse(addr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: %w\", addr, err)\n\t}\n\tif u.User != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: userinfo is not allowed\", addr)\n\t}\n\tif u.Scheme == \"https\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: use http:// — sidecar is \"+\n\t\t\t\"same-host only (loopback or virtual same-host bridge), so TLS adds \"+\n\t\t\t\"no security; cross-machine deployment is out of scope\", addr)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: scheme must be http\", addr)\n\t}\n\tif u.Host == \"\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: missing host\", addr)\n\t}\n\tif u.Path != \"\" && u.Path != \"/\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: path is not allowed\", addr)\n\t}\n\t// u.Hostname() strips the port and unwraps IPv6 brackets.\n\tif !isSameHost(u.Hostname()) {\n\t\treturn errNotSameHost(addr)","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/sidecar/protocol.go#L145-L181","documentation":"ValidateProxyAddr rejects any userinfo (user:pass@) in the proxy URL unconditionally, because the sidecar protocol authenticates with HMAC headers, not HTTP basic auth; the userinfo slot only enables phishing like http://127.0.0.1@attacker.com where the visible host is not the real host.","triggerScenarios":"ValidateProxyAddr is called (via ResolveAccount / ResolveInterceptor / init) with a value containing '@' userinfo, e.g. \"http://user:pass@127.0.0.1:16384\" or \"http://127.0.0.1@attacker.com:16384\" — often from pasting a generic proxy URL that includes credentials.","commonSituations":"Reusing a corporate HTTP proxy URL (which commonly embeds basic-auth credentials) as the sidecar address; migrating config from a standard proxy tool; a phishing/decoy URL that hides the real host behind a plausible userinfo.","solutions":["Remove the user:pass@ portion and keep only `http://host:port`, e.g. `export LARKSUITE_CLI_AUTH_PROXY=\"http://127.0.0.1:16384\"`.","Do not use basic-auth proxy URLs here — the sidecar authenticates via HMAC headers (X-Lark-Proxy-Signature), so credentials in the URL are unnecessary and unsupported.","Double-check the host after the '@' is the one you intend; if you pasted a URL with '@', the real host may not be loopback.","Run the sidecar locally and use its plain loopback address."],"exampleFix":"// before\nexport LARKSUITE_CLI_AUTH_PROXY=\"http://user:secret@127.0.0.1:16384\"\n// after\nexport LARKSUITE_CLI_AUTH_PROXY=\"http://127.0.0.1:16384\"","handlingStrategy":"validation","validationCode":"u, _ := url.Parse(addr)\nif u != nil && u.User != nil {\n\treturn errors.New(\"proxy URL must not contain user:pass@; sidecar uses HMAC headers, not basic auth\")\n}","typeGuard":"func hasNoUserinfo(addr string) bool {\n\tu, err := url.Parse(addr)\n\treturn err == nil && u.User == nil\n}","tryCatchPattern":"if err := sidecar.ValidateProxyAddr(addr); err != nil {\n\tif strings.Contains(err.Error(), \"userinfo is not allowed\") {\n\t\treturn fmt.Errorf(\"strip user:pass@ from LARKSUITE_CLI_AUTH_PROXY; auth is via HMAC headers: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Never paste basic-auth proxy URLs into LARKSUITE_CLI_AUTH_PROXY.","Strip credentials before validation; keep secrets out of env values anyway.","Be suspicious of URLs where the host before '@' differs from the intended host (phishing pattern).","Configure sidecar authentication via the shared HMAC key instead."],"tags":["security","configuration","proxy-address","phishing","sidecar"],"backgroundTag":"userinfo-in-proxy-url","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}