{"record":{"id":"a3ba4701260431e1","repo":"cloudflare/cloudflared","slug":"s-is-an-invalid-address-ingress-rules-don-t-supp","errorCode":null,"errorMessage":"%s is an invalid address, ingress rules don't support proxying to a different path on the origin service. The path will be the same as the eyeball request's path","messagePattern":"(.+?) is an invalid address, ingress rules don't support proxying to a different path on the origin service\\. The path will be the same as the eyeball request's path","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":305,"sourceCode":"\t\t} else if r.Service == ServiceBastion || cfg.BastionMode {\n\t\t\t// Bastion mode will always start a Websocket proxy server, which will\n\t\t\t// overwrite the localService.URL field when `start` is called. So,\n\t\t\t// leave the URL field empty for now.\n\t\t\tcfg.BastionMode = true\n\t\t\tservice = newBastionService()\n\t\t} else {\n\t\t\t// Validate URL services\n\t\t\tu, err := url.Parse(r.Service)\n\t\t\tif err != nil {\n\t\t\t\treturn Ingress{}, err\n\t\t\t}\n\n\t\t\tif u.Scheme == \"\" || u.Hostname() == \"\" {\n\t\t\t\treturn Ingress{}, fmt.Errorf(\"%s is an invalid address, please make sure it has a scheme and a hostname\", r.Service)\n\t\t\t}\n\n\t\t\tif u.Path != \"\" {\n\t\t\t\treturn Ingress{}, fmt.Errorf(\"%s is an invalid address, ingress rules don't support proxying to a different path on the origin service. The path will be the same as the eyeball request's path\", r.Service)\n\t\t\t}\n\t\t\tif isHTTPService(u) {\n\t\t\t\tservice = &httpService{url: u}\n\t\t\t} else {\n\t\t\t\tservice = newTCPOverWSService(u)\n\t\t\t}\n\t\t}\n\n\t\tvar handlers []middleware.Handler\n\t\tif access := r.OriginRequest.Access; access != nil {\n\t\t\tif err := validateAccessConfiguration(access); err != nil {\n\t\t\t\treturn Ingress{}, err\n\t\t\t}\n\t\t\tif access.Required {\n\t\t\t\tverifier := middleware.NewJWTValidator(access.TeamName, access.Environment, access.AudTag)\n\t\t\t\thandlers = append(handlers, verifier)\n\t\t\t}\n\t\t}","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L287-L323","documentation":"ingress rules proxy requests with the same path the eyeball used, so a service URL containing a path component is rejected. validateIngress checks u.Path after scheme/host validation and returns this error when any path is present on the origin service URL.","triggerScenarios":"ParseIngress/UnmarshalJSON on a service value like `http://localhost:8080/api` or `https://backend.internal/v2` — any non-empty URL path triggers the error.","commonSituations":"Users expecting ingress rules to rewrite paths (like a reverse proxy with prefix stripping), copying an origin URL including its base path from another proxy config.","solutions":["Remove the path from the service URL, keeping only scheme://host[:port]","Handle path routing via multiple ingress rules with `path` matchers instead of origin paths","If path rewriting is required, put a reverse proxy in front of the origin"],"exampleFix":"// before\nservice: http://localhost:8080/api\n// after\nservice: http://localhost:8080","handlingStrategy":"validation","validationCode":"if u, err := url.Parse(svc); err == nil && u.Path != \"\" {\n\treturn fmt.Errorf(\"service %q must not include a path\", svc)\n}","typeGuard":null,"tryCatchPattern":"if err := ingress.ParseIngress(cfg); err != nil {\n\tif strings.Contains(err.Error(), \"don't support proxying to a different path\") {\n\t\t// strip the path or move routing to ingress path matchers\n\t}\n\treturn err\n}","preventionTips":["Keep origin service URLs path-free","Use ingress rule `path` matchers for path-based routing","Document that path rewriting needs an external reverse proxy"],"tags":["ingress","url-validation","path"],"backgroundTag":"invalid-url-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}