{"record":{"id":"d04dedc1349c2e41","repo":"googleapis/mcp-toolbox","slug":"invalid-auth-url","errorCode":null,"errorMessage":"invalid auth URL","messagePattern":"invalid auth URL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":126,"sourceCode":"\treturn &http.Client{\n\t\tTimeout: 10 * time.Second,\n\t\tTransport: &http.Transport{\n\t\t\tForceAttemptHTTP2:     true,\n\t\t\tMaxIdleConns:          10,\n\t\t\tIdleConnTimeout:       90 * time.Second,\n\t\t\tTLSHandshakeTimeout:   5 * time.Second,\n\t\t\tExpectContinueTimeout: 1 * time.Second,\n\t\t},\n\t\tCheckRedirect: func(req *http.Request, via []*http.Request) error {\n\t\t\treturn http.ErrUseLastResponse\n\t\t},\n\t}\n}\n\nfunc discoverOIDCConfig(client *http.Client, AuthorizationServer string) (jwksURI string, introspectionEndpoint string, issuer string, err error) {\n\tu, err := url.Parse(AuthorizationServer)\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"invalid auth URL\")\n\t}\n\tif u.Scheme != \"https\" {\n\t\tlog.Printf(\"WARNING: HTTP instead of HTTPS is being used for AuthorizationServer: %s\", AuthorizationServer)\n\t}\n\n\toidcConfigURL, err := url.JoinPath(AuthorizationServer, \".well-known/openid-configuration\")\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tresp, err := client.Get(oidcConfigURL)\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"failed to fetch OIDC config: %w\", err)\n\t}\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"unexpected status: %d\", resp.StatusCode)","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L108-L144","documentation":"Returned by discoverOIDCConfig when url.Parse cannot parse the configured AuthorizationServer string. Discovery cannot proceed without a valid URL, so Initialize aborts. Note this fires only on genuinely unparseable input (e.g. control characters); most malformed-but-parseable URLs pass through and fail later at fetch time.","triggerScenarios":"Config.Initialize() called with a Config whose AuthorizationServer field contains a string that net/url.Parse rejects (invalid characters, malformed percent-encoding).","commonSituations":"Pasting a URL with stray whitespace/newlines or unescaped '%' characters into the authorizationServer YAML field; environment-variable interpolation producing an invalid value.","solutions":["Check the authorizationServer value for stray characters, newlines, or invalid percent-encodings","Ensure it is a well-formed absolute URL like https://auth.example.com","Validate with a quick Go snippet: url.Parse(value) before deploying","Percent-encode special characters (e.g. use %25 for a literal %)"],"exampleFix":"// before\nauthorizationServer: \"https://auth.example.com%bad\"\n// after\nauthorizationServer: \"https://auth.example.com\"","handlingStrategy":"validation","validationCode":"if u, err := url.Parse(cfg.AuthorizationServer); err != nil {\n    return fmt.Errorf(\"invalid authorizationServer %q: %v\", cfg.AuthorizationServer, err)\n}","typeGuard":null,"tryCatchPattern":"_, err := cfg.Initialize()\nif err != nil && strings.Contains(err.Error(), \"invalid auth URL\") {\n    log.Fatalf(\"fix authorizationServer YAML value: %v\", err)\n}","preventionTips":["Trim whitespace/newlines from config values loaded from env or YAML","Escape literal % as %25 in URLs","Lint the auth config with url.Parse before deployment"],"tags":["go","url","config"],"backgroundTag":"invalid-url-config","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}