{"record":{"id":"969ff03d1d575ed1","repo":"caddyserver/caddy","slug":"making-request-v","errorCode":null,"errorMessage":"making request: %v","messagePattern":"making request: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/commandfuncs.go","lineNumber":799,"sourceCode":"\t\torigin = \"http://127.0.0.1\" // bogus host is a hack so that http.NewRequest() is happy\n\n\t\t// the unix address at this point might still contain the optional\n\t\t// unix socket permissions, which are part of the address/host.\n\t\t// those need to be removed first, as they aren't part of the\n\t\t// resulting unix file path\n\t\taddr, _, err := internal.SplitUnixSocketPermissionsBits(parsedAddr.Host)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tparsedAddr.Host = addr\n\t} else if parsedAddr.IsFdNetwork() {\n\t\torigin = \"http://127.0.0.1\"\n\t}\n\n\t// form the request\n\treq, err := http.NewRequest(method, origin+uri, body)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"making request: %v\", err)\n\t}\n\tif parsedAddr.IsUnixNetwork() || parsedAddr.IsFdNetwork() {\n\t\t// We used to conform to RFC 2616 Section 14.26 which requires\n\t\t// an empty host header when there is no host, as is the case\n\t\t// with unix sockets and socket fds. However, Go required a\n\t\t// Host value so we used a hack of a space character as the host\n\t\t// (it would see the Host was non-empty, then trim the space later).\n\t\t// As of Go 1.20.6 (July 2023), this hack no longer works. See:\n\t\t// https://github.com/golang/go/issues/60374\n\t\t// See also the discussion here:\n\t\t// https://github.com/golang/go/issues/61431\n\t\t//\n\t\t// After that, we now require a Host value of either 127.0.0.1\n\t\t// or ::1 if one is set. Above I choose to use 127.0.0.1. Even\n\t\t// though the value should be completely irrelevant (it could be\n\t\t// \"srldkjfsd\"), if for some reason the Host *is* used, at least\n\t\t// we can have some reasonable assurance it will stay on the local\n\t\t// machine and that browsers, if they ever allow access to unix","sourceCodeStart":781,"sourceCodeEnd":817,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/cmd/commandfuncs.go#L781-L817","documentation":"Returned when http.NewRequest rejects the request line assembled from the origin plus the URI in AdminAPIRequest. Because the origin is normalized ('http://127.0.0.1' for unix/fd, or the parsed host:port otherwise), failure almost always means the URI passed by the calling CLI command is malformed (spaces, control characters, or an invalid method string).","triggerScenarios":"A CLI command builds a URI containing unescaped characters or the method string is not a valid HTTP token. Rarely triggered by user input directly; usually a bug in a custom command or plugin invoking AdminAPIRequest with a bad uri/method.","commonSituations":"Third-party Caddy CLI plugins calling AdminAPIRequest with a URI that contains spaces or non-ASCII, or an empty method.","solutions":["URL-encode path and query segments before passing them as the uri argument","Use a standard HTTP method string (GET, POST, DELETE)","If you see this as a Caddy user (not a plugin author), report it — a built-in command constructed an invalid request"],"exampleFix":"// before\nresp, err := cmd.AdminAPIRequest(addr, \"GET\", \"/config/\"+strings.ReplaceAll(path, \" \", \" \"), nil, nil)\n\n// after\nresp, err := cmd.AdminAPIRequest(addr, \"GET\", \"/config/\"+url.PathEscape(path), nil, nil)","handlingStrategy":"validation","validationCode":"// Encode dynamic path/query segments before building the URI for AdminAPIRequest:\nuri := \"/config/\" + url.PathEscape(userPath)","typeGuard":null,"tryCatchPattern":"err := apiCall(); if err != nil && strings.HasPrefix(err.Error(), \"making request:\") { /* fix uri/method and retry once */ }","preventionTips":["Treat CLI command inputs as untrusted data and escape them into URIs","Use only standard HTTP method tokens"],"tags":["cli","admin-api","http-client","internal"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}