{"record":{"id":"6bf47cf17efabb87","repo":"hashicorp/vault","slug":"invalid-url","errorCode":null,"errorMessage":"Invalid URL","messagePattern":"Invalid URL","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ui/app/components/oidc-consent-block.js","lineNumber":43,"sourceCode":"export default class OidcConsentBlockComponent extends Component {\n  @tracked didCancel = false;\n\n  get win() {\n    return this.window || window;\n  }\n\n  buildUrl(urlString, params) {\n    try {\n      const url = new URL(urlString);\n      Object.keys(params).forEach((key) => {\n        if (params[key] && validParameters.includes(key)) {\n          url.searchParams.append(key, params[key]);\n        }\n      });\n      return url;\n    } catch (e) {\n      console.debug('DEBUG: parsing url failed for', urlString); // eslint-disable-line\n      throw new Error('Invalid URL');\n    }\n  }\n\n  @action\n  handleSubmit(evt) {\n    evt.preventDefault();\n    const { redirect, ...params } = this.args;\n    const redirectUrl = this.buildUrl(redirect, params);\n    if (Ember.testing) {\n      this.args.testRedirect(redirectUrl.toString());\n    } else {\n      this.win.location.replace(redirectUrl);\n    }\n  }\n\n  @action\n  handleCancel(evt) {\n    evt.preventDefault();","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/hashicorp/vault/blob/744b611b5700b3b7f82d76b4d6938a91b9989367/ui/app/components/oidc-consent-block.js#L25-L61","documentation":"Thrown by the OIDC consent screen component (ui/app/components/oidc-consent-block.js:43). After a user consents (prompt=consent flow on Vault's identity OIDC provider), the component rebuilds the redirect URL by appending query params to the redirect target using new URL(). The URL constructor throws a TypeError on input that is not an absolute, parseable URL; the component catches it, logs a console.debug with the raw value, and rethrows this generic message.","triggerScenarios":"The redirect arg passed to the consent block (the redirect_uri originally supplied to /v1/identity/oidc/provider/<name>/authorize) is empty, relative (e.g. /callback), or otherwise malformed, so new URL(urlString) throws in buildUrl().","commonSituations":"The client application registered a relative or malformed redirect_uri; a reverse proxy rewrote or stripped the scheme from the callback URL; query params were lost or double-decoded in transit.","solutions":["Check the console for 'DEBUG: parsing url failed for' to see the exact malformed value","Fix the redirect_uri on the relying party / Vault OIDC client assignment so it is an absolute URL (https://app.example.com/callback)","Re-run the authorization request with the corrected redirect_uri"],"exampleFix":"// before\nbuildUrl(urlString, params) {\n  try {\n    const url = new URL(urlString);\n    ...\n  } catch (e) {\n    throw new Error('Invalid URL');\n  }\n}\n\n// after: validate early with a clear message\nbuildUrl(urlString, params) {\n  if (!URL.canParse(urlString)) {\n    throw new Error(`Invalid redirect URL: \"${urlString}\" is not an absolute URL.`);\n  }\n  const url = new URL(urlString);\n  ...\n}","handlingStrategy":"validation","validationCode":"// Validate the redirect target before building the consent URL\nfunction isValidAbsoluteUrl(value) {\n  try {\n    new URL(value);\n    return true;\n  } catch {\n    return false;\n  }\n}\n// or on modern browsers/node: URL.canParse(value)\n\nif (!isValidAbsoluteUrl(this.args.redirect)) {\n  showError('redirect_uri must be an absolute URL');\n  return;\n}","typeGuard":null,"tryCatchPattern":"try {\n  const redirectUrl = this.buildUrl(redirect, params);\n} catch (e) {\n  if (e.message === 'Invalid URL') {\n    // the console.debug line holds the raw string that failed to parse\n    showError('Redirect URL is invalid — check console for the raw value and fix the client redirect_uri');\n  } else {\n    throw e;\n  }\n}","preventionTips":["Always register absolute redirect_uri values (scheme + host) on relying parties","Validate redirect URLs with URL.canParse() before starting an OIDC flow","Watch for proxies that rewrite or strip schemes from callback URLs"],"tags":["oidc","url-parsing","consent","redirect-uri"],"backgroundTag":null,"analyzedSha":"744b611b5700b3b7f82d76b4d6938a91b9989367","analyzedAt":"2026-08-15T14:40:29.333Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}