{"record":{"id":"3e54e0a72d9d3227","repo":"larksuite/cli","slug":"invalid-proxy-address-q-expected-host-port-or-ht","errorCode":null,"errorMessage":"invalid proxy address %q: expected host:port or http://host:port","messagePattern":"invalid proxy address %q: expected host:port or http://host:port","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sidecar/protocol.go","lineNumber":147,"sourceCode":"// TLS adds no security. Cross-machine deployment is out of scope (see the\n// host constraint above), so there is no scenario today where https\n// provides a real benefit over http on loopback.\n//\n// userinfo (user:pass@) is rejected unconditionally — the sidecar protocol\n// does not use basic auth, and the syntactic slot exists only as a phishing\n// vector (e.g. http://127.0.0.1@attacker.com).\n//\n// Returns an error if the value is not a valid proxy address.\nfunc ValidateProxyAddr(addr string) error {\n\tif addr == \"\" {\n\t\treturn fmt.Errorf(\"proxy address is empty\")\n\t}\n\n\t// Bare host:port (no scheme) — validate as a net address.\n\tif !strings.Contains(addr, \"://\") {\n\t\thost, port, err := net.SplitHostPort(addr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: expected host:port or http://host:port\", addr)\n\t\t}\n\t\tif host == \"\" || port == \"\" {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: host and port must not be empty\", addr)\n\t\t}\n\t\tif !isSameHost(host) {\n\t\t\treturn errNotSameHost(addr)\n\t\t}\n\t\treturn nil\n\t}\n\n\tu, err := url.Parse(addr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: %w\", addr, err)\n\t}\n\tif u.User != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: userinfo is not allowed\", addr)\n\t}\n\tif u.Scheme == \"https\" {","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/sidecar/protocol.go#L129-L165","documentation":"When LARKSUITE_CLI_AUTH_PROXY has no '://' scheme, ValidateProxyAddr treats it as a bare host:port and parses it with net.SplitHostPort. This error means the value is not a parseable host:port — e.g. missing port, unbalanced IPv6 brackets, stray characters, or a URL-ish string without a recognized scheme separator.","triggerScenarios":"Calling ValidateProxyAddr (via ResolveAccount / ResolveInterceptor / init) with values like \"127.0.0.1\" (no port), \":16384\" (no host is actually caught next, but \"127.0.0.1:\" hits this via empty port), \"localhost 16384\" (space), \"[::1]:16384:extra\", or \"127.0.0.1:16384/path\".","commonSituations":"Typing just the host without a port; pasting a full URL but omitting the scheme while keeping a path; copy/paste introducing whitespace; port included twice; missing IPv6 brackets.","solutions":["Use the full form `http://host:port`, e.g. `export LARKSUITE_CLI_AUTH_PROXY=\"http://127.0.0.1:16384\"`.","Or use a plain `host:port` with both parts present: `127.0.0.1:16384` (DefaultListenAddr).","Wrap IPv6 hosts in brackets exactly once: `[::1]:16384`.","Remove any path, spaces, or trailing junk from the value; the address must be scheme-optional host:port or a full http:// URL with no path."],"exampleFix":"// before\nexport LARKSUITE_CLI_AUTH_PROXY=\"127.0.0.1\"\n// after\nexport LARKSUITE_CLI_AUTH_PROXY=\"127.0.0.1:16384\"","handlingStrategy":"validation","validationCode":"func validProxyAddrFormat(addr string) bool {\n\tif strings.Contains(addr, \"://\") {\n\t\tu, err := url.Parse(addr)\n\t\treturn err == nil && u.Scheme == \"http\" && u.Host != \"\"\n\t}\n\t_, _, err := net.SplitHostPort(addr)\n\treturn err == nil\n}","typeGuard":null,"tryCatchPattern":"if err := sidecar.ValidateProxyAddr(addr); err != nil {\n\tif strings.Contains(err.Error(), \"expected host:port or http://host:port\") {\n\t\treturn fmt.Errorf(\"%q is not host:port; use http://127.0.0.1:16384\", addr)\n\t}\n\treturn err\n}","preventionTips":["Always write the full form http://host:port to avoid bare-address parsing.","Include the port explicitly; the sidecar default is 16384.","Wrap IPv6 in exactly one pair of brackets: [::1]:16384.","Trim whitespace before validating; reject values containing spaces or paths."],"tags":["configuration","proxy-address","url-parsing","sidecar"],"backgroundTag":"invalid-proxy-address","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}