{"record":{"id":"7dd9f04cf5efa7cc","repo":"nats-io/nats-server","slug":"invalid-proxy-url-v","errorCode":null,"errorMessage":"invalid proxy URL: %v","messagePattern":"invalid proxy URL: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":400,"sourceCode":"\tfor _, u := range o.LeafNode.Users {\n\t\tif _, exists := users[u.Username]; exists {\n\t\t\treturn fmt.Errorf(\"duplicate user %q detected in leafnode authorization\", u.Username)\n\t\t}\n\t\tusers[u.Username] = struct{}{}\n\t}\n\treturn nil\n}\n\nfunc validateLeafNodeProxyOptions(remote *RemoteLeafOpts) ([]string, error) {\n\tvar warnings []string\n\n\tif remote.Proxy.URL == _EMPTY_ {\n\t\treturn warnings, nil\n\t}\n\n\tproxyURL, err := url.Parse(remote.Proxy.URL)\n\tif err != nil {\n\t\treturn warnings, fmt.Errorf(\"invalid proxy URL: %v\", err)\n\t}\n\n\tif proxyURL.Scheme != \"http\" && proxyURL.Scheme != \"https\" {\n\t\treturn warnings, fmt.Errorf(\"proxy URL scheme must be http or https, got: %s\", proxyURL.Scheme)\n\t}\n\n\tif proxyURL.Host == _EMPTY_ {\n\t\treturn warnings, fmt.Errorf(\"proxy URL must specify a host\")\n\t}\n\n\tif remote.Proxy.Timeout < 0 {\n\t\treturn warnings, fmt.Errorf(\"proxy timeout must be >= 0\")\n\t}\n\n\tif (remote.Proxy.Username == _EMPTY_) != (remote.Proxy.Password == _EMPTY_) {\n\t\treturn warnings, fmt.Errorf(\"proxy username and password must both be specified or both be empty\")\n\t}\n","sourceCodeStart":382,"sourceCodeEnd":418,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L382-L418","documentation":"validateLeafNodeProxyOptions parses the remote leaf node's proxy URL with net/url.Parse and wraps any parse failure as \"invalid proxy URL: %v\". The proxy setting is used to dial remote leaf nodes through an HTTP(S) proxy, so the value must be a syntactically valid URL. Thrown from validateLeafNode and parseRemoteLeafNodes.","triggerScenarios":"A remote leafnode block sets proxy { url: \"...\" } with a string net/url.Parse cannot parse — e.g. missing scheme with stray characters, invalid percent-escapes, or control characters; raised during option validation or leafnode config parsing.","commonSituations":"Typing `proxy url: 127.0.0.1:3128` (no scheme) combined with characters url.Parse rejects, or pasting URLs with spaces/newlines from documentation or environment variables.","solutions":["Read the wrapped %v parse error to see the exact syntax problem","Provide a fully-qualified URL with scheme and host, e.g. \"http://proxy.corp:3128\"","URL-encode or remove special characters (spaces, raw non-ASCII) in the value"],"exampleFix":"// before\nproxy { url: \"proxy.corp:3128 proxy2\" }\n// after\nproxy { url: \"http://proxy.corp:3128\" }","handlingStrategy":"validation","validationCode":"if p := cfg.LeafNodes.Proxy.URL; p != \"\" {\n  if _, err := url.Parse(p); err != nil {\n    return fmt.Errorf(\"invalid proxy URL %q: %v\", p, err)\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include scheme://host in proxy URLs","Trim whitespace/newlines from values loaded from env vars","Test proxy settings with a small dial script before production"],"tags":["leafnode","proxy","url-parsing","config-validation"],"backgroundTag":"invalid-url","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}