{"record":{"id":"c4c3c6f8ab44fe29","repo":"eclipse-vertx/vert.x","slug":"invalid-authority-host-portion","errorCode":null,"errorMessage":"Invalid authority host portion: ","messagePattern":"Invalid authority host portion: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/HostAndPort.java","lineNumber":56,"sourceCode":"   * @param string the string to parse\n   * @param schemePort the scheme port used when the optional port is not specified\n   * @return the parsed authority or {@code null} when the {@code string} does not represent a valid authority.\n   */\n  static HostAndPort parseAuthority(String string, int schemePort) {\n    return HostAndPortImpl.parseAuthority(string, schemePort);\n  }\n\n  /**\n   * Create an instance with a valid {@code host} for a valid authority: the {@code host} must\n   * match the <i>host</i> rule of <a href=\"https://datatracker.ietf.org/doc/html/rfc3986#appendix-A\">rfc3986</a>.\n   *\n   * @param host the host portion\n   * @param port the port\n   * @return the instance\n   */\n  static HostAndPort authority(String host, int port) {\n    if (!HttpUtils.isValidHostAuthority(host)) {\n      throw new IllegalArgumentException(\"Invalid authority host portion: \" + host);\n    }\n    return new HostAndPortImpl(host, port);\n  }\n\n  /**\n   * Like {@link #authority(String, int)} without a port, {@code -1} is used instead.\n   */\n  static HostAndPort authority(String host) {\n    return authority(host, -1);\n  }\n\n  /**\n   * @return the host value\n   */\n  String host();\n\n  /**\n   * @return the port value or {@code -1} when not specified","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/HostAndPort.java#L38-L74","documentation":"HostAndPort.authority(String host, int port) validates the host portion with HttpUtils.isValidHostAuthority and throws IllegalArgumentException if it is not a valid authority (host) form per HTTP semantics. The authority component must not contain characters like '/', '?', '#', '@' or whitespace.","triggerScenarios":"Calling HostAndPort.authority(host, port) with a host string that still contains a scheme, path, userinfo or port, e.g. authority(\"https://example.com/path\", 443), authority(\"user@example.com\", 8080), or an empty/null-ish host string.","commonSituations":"Parsing a full URL or authority string (like an HTTP Host header) and passing the entire value as the host instead of extracting just the host part; user-supplied hostnames with embedded invalid characters.","solutions":["Strip scheme, userinfo, path and port from the URL/Host header before calling authority()","Use java.net.URI parsing (new URI(str)).getHost() to extract the host portion","Validate the host with HttpUtils.isValidHostAuthority before calling"],"exampleFix":"// before\nHostAndPort.authority(request.getHeader(\"Host\"), -1); // may include ':port'\n// after\nString host = new URI(\"http://\" + request.getHeader(\"Host\")).getHost();\nHostAndPort.authority(host, -1);","handlingStrategy":"validation","validationCode":"URI uri = new URI(raw);\nString host = uri.getHost();\nif (host == null || !io.vertx.core.http.HttpUtils.isValidHostAuthority(host)) {\n  throw new IllegalArgumentException(\"not a valid authority host: \" + raw);\n}\nHostAndPort.authority(host, uri.getPort());","typeGuard":"boolean isValidAuthorityHost(String h) { return h != null && !h.isEmpty() && io.vertx.core.http.HttpUtils.isValidHostAuthority(h); }","tryCatchPattern":"try {\n  HostAndPort hp = HostAndPort.authority(host, port);\n} catch (IllegalArgumentException e) {\n  log.error(\"Bad host '{}' - strip scheme/path/userinfo/port first\", host, e);\n}","preventionTips":["Never pass a full URL or Host header as the host argument","Use URI parsing to extract the host portion","Reject user-supplied hosts containing '/', '@', ':' or whitespace before use"],"tags":["validation","host","uri","illegal-argument"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}