{"record":{"id":"ddac678c0dd8eae7","repo":"cloudflare/cloudflared","slug":"error-validating-origin-url-ddac67","errorCode":null,"errorMessage":"Error validating origin URL","messagePattern":"Error validating origin URL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":173,"sourceCode":"\tingress := Ingress{\n\t\tRules:    defaultRule,\n\t\tDefaults: defaults,\n\t}\n\treturn ingress\n}\n\n// Get a single origin service from the CLI/config.\nfunc parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (OriginService, error) {\n\tif c.IsSet(HelloWorldFlag) {\n\t\treturn new(helloWorld), nil\n\t}\n\tif c.IsSet(config.BastionFlag) {\n\t\treturn newBastionService(), nil\n\t}\n\tif c.IsSet(\"url\") {\n\t\toriginURL, err := config.ValidateUrl(c, allowURLFromArgs)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Error validating origin URL\")\n\t\t}\n\t\tif isHTTPService(originURL) {\n\t\t\treturn &httpService{\n\t\t\t\turl: originURL,\n\t\t\t}, nil\n\t\t}\n\t\treturn newTCPOverWSService(originURL), nil\n\t}\n\tif c.IsSet(\"unix-socket\") {\n\t\tpath, err := config.ValidateUnixSocket(c)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Error validating --unix-socket\")\n\t\t}\n\t\treturn &unixSocketPath{path: path, scheme: \"http\"}, nil\n\t}\n\treturn nil, ErrNoIngressRulesCLI\n}\n","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L155-L191","documentation":"parseSingleOriginService validates the --url flag value with config.ValidateUrl when building a single-origin ingress from CLI flags. Any validation failure (unparseable URL, disallowed scheme, missing host) is wrapped as 'Error validating origin URL'. It guards that the origin cloudflared proxies to is a usable URL.","triggerScenarios":"Running cloudflared with `--url <value>` (e.g. `cloudflared tunnel --url ...` or `cloudflared tunnel route ...`) where the value is not a valid URL: missing scheme, typo like 'http:/localhost:8080', unsupported scheme (ftp://), or an unparseable host/port combination.","commonSituations":"Forgetting the scheme (localhost:8080 may fail depending on validation), typos in the URL, using --url together with a config-file ingress incorrectly, or service URLs with credentials/special characters that break parsing.","solutions":["Use a fully qualified origin URL: `--url http://localhost:8080`.","Check the scheme is supported (http, https, or tcp-style per the service type).","Verify host/port are correct and the service is formatted as a valid URL.","If pointing at a unix socket, use --unix-socket instead of a file:// URL."],"exampleFix":"// before\ncloudflared tunnel --url localhost:8080\n// after\ncloudflared tunnel --url http://localhost:8080","handlingStrategy":"validation","validationCode":"// Go: validate the origin URL before passing --url\nu, err := url.Parse(originArg)\nvalid := err == nil &&\n\t(u.Scheme == \"http\" || u.Scheme == \"https\") &&\n\tu.Host != \"\"\nif !valid {\n\t// fix the argument before invoking cloudflared\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include an explicit scheme: http:// or https://.","Never embed credentials or paths in --url; keep it scheme://host:port.","Use --unix-socket for socket-based origins instead of a file:// URL.","Test the URL with a curl to the origin before wiring it into cloudflared."],"tags":["cli","url-validation","ingress","config","cloudflare"],"backgroundTag":"invalid-url","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}