{"record":{"id":"aaf905ab4a8bf47f","repo":"ory/hydra","slug":"failed-to-create-request-s","errorCode":null,"errorMessage":"Failed to create request: %s","messagePattern":"Failed to create request: (.+?)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"cmd/cmd_perform_device_flow.go","lineNumber":206,"sourceCode":"\t// Accept the user code with a hand-rolled request instead of the generated\n\t// client: other modules in this repository compile this package against the\n\t// released hydra-client-go/v2 module, which predates the device\n\t// authorization API.\n\tcfg := s.cl.GetConfig()\n\tif len(cfg.Servers) == 0 {\n\t\thttp.Error(w, \"No Hydra endpoint is configured\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\tacceptURL := strings.TrimSuffix(cfg.Servers[0].URL, \"/\") +\n\t\t\"/admin/oauth2/auth/requests/device/accept?device_challenge=\" + url.QueryEscape(challenge)\n\tbody, err := json.Marshal(map[string]string{\"user_code\": userCode})\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to encode request body: %s\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n\treq, err := http.NewRequestWithContext(r.Context(), http.MethodPut, acceptURL, bytes.NewReader(body))\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to create request: %s\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\treq.Header.Set(\"Accept\", \"application/json\")\n\n\thc := cfg.HTTPClient\n\tif hc == nil {\n\t\thc = http.DefaultClient\n\t}\n\tres, err := hc.Do(req)\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to accept user code request: %s\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n\tdefer res.Body.Close() //nolint:errcheck\n\traw, err := io.ReadAll(io.LimitReader(res.Body, 1<<20))\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to read response: %s\", err), http.StatusInternalServerError)","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/cmd/cmd_perform_device_flow.go#L188-L224","documentation":"Returned when http.NewRequestWithContext fails to construct the PUT request to the Hydra admin device-accept URL. NewRequestWithContext only errors on an invalid method or an unparseable URL, so this almost always means acceptURL is malformed. The handler responds with a 500 containing the parse error.","triggerScenarios":"url.Parse inside http.NewRequestWithContext fails on acceptURL built as cfg.Servers[0].URL + \"/admin/oauth2/auth/requests/device/accept?device_challenge=\" + query-escaped challenge. This happens when cfg.Servers[0].URL contains invalid characters, control characters, whitespace, or is empty/garbage (bad config).","commonSituations":"Misconfigured server URL in the Hydra/ory CLI config (trailing garbage, embedded spaces or newlines from env vars), empty Servers array handled elsewhere but a server entry with a malformed URL, or copy-pasted URLs with invisible characters.","solutions":["Print/validate cfg.Servers[0].URL before building acceptURL; run it through url.Parse and fail fast with a clear config error.","Normalize the config value: strings.TrimSpace and reject values that do not start with http:// or https://.","Since the device_challenge is already url.QueryEscape'd, ensure no double-escaping or manual concatenation of raw query strings; build with url.Values instead."],"exampleFix":"// before\nacceptURL := strings.TrimSuffix(cfg.Servers[0].URL, \"/\") +\n\t\"/admin/oauth2/auth/requests/device/accept?device_challenge=\" + url.QueryEscape(challenge)\n// after\nbase, err := url.Parse(strings.TrimSpace(cfg.Servers[0].URL))\nif err != nil {\n\thttp.Error(w, \"Invalid server URL in configuration\", http.StatusInternalServerError)\n\treturn\n}\nbase.Path = strings.TrimSuffix(base.Path, \"/\") + \"/admin/oauth2/auth/requests/device/accept\"\nq := base.Query(); q.Set(\"device_challenge\", challenge); base.RawQuery = q.Encode()\nacceptURL := base.String()","handlingStrategy":"validation","validationCode":"u, err := url.Parse(cfg.Servers[0].URL)\nif err != nil || (u.Scheme != \"http\" && u.Scheme != \"https\") || u.Host == \"\" {\n\treturn fmt.Errorf(\"invalid server URL in config: %q\", cfg.Servers[0].URL)\n}","typeGuard":"func isValidHTTPURL(s string) bool {\n\tu, err := url.Parse(strings.TrimSpace(s))\n\treturn err == nil && (u.Scheme == \"http\" || u.Scheme == \"https\") && u.Host != \"\"\n}","tryCatchPattern":"req, err := http.NewRequestWithContext(ctx, http.MethodPut, acceptURL, body)\nif err != nil {\n\tlog.Printf(\"bad request URL %q: %v\", acceptURL, err)\n\thttp.Error(w, \"invalid admin URL\", http.StatusInternalServerError)\n\treturn\n}","preventionTips":["Validate server URLs at config-load time, before any request is built","Trim whitespace on URL values read from env/config files","Build query strings with url.Values instead of string concatenation"],"tags":["http","url","config"],"backgroundTag":"invalid-url","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}