{"record":{"id":"df08ae82ec53f8e0","repo":"grpc/grpc-java","slug":"audience-url-is-empty-metadata-value-must-contain","errorCode":null,"errorMessage":"Audience URL is empty. Metadata value must contain a valid URL.","messagePattern":"Audience URL is empty\\. Metadata value must contain a valid URL\\.","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/GcpAuthenticationFilter.java","lineNumber":324,"sourceCode":"      }\n    }\n\n    @Override\n    public String getTypeUrl() {\n      return \"type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.Audience\";\n    }\n\n    @Override\n    public AudienceWrapper parse(Any any) throws ResourceInvalidException {\n      Audience audience;\n      try {\n        audience = any.unpack(Audience.class);\n      } catch (InvalidProtocolBufferException ex) {\n        throw new ResourceInvalidException(\"Invalid Resource in address proto\", ex);\n      }\n      String url = audience.getUrl();\n      if (url.isEmpty()) {\n        throw new ResourceInvalidException(\n            \"Audience URL is empty. Metadata value must contain a valid URL.\");\n      }\n      return new AudienceWrapper(url);\n    }\n  }\n}\n","sourceCodeStart":306,"sourceCodeEnd":331,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/GcpAuthenticationFilter.java#L306-L331","documentation":"After successfully unpacking the Audience proto, GcpAuthenticationFilter's AudienceWrapper.parse validates that audience.getUrl() is non-empty; if empty it throws ResourceInvalidException 'Audience URL is empty. Metadata value must contain a valid URL.'. The gcp_authn filter needs a target audience URL to fetch GCP identity tokens.","triggerScenarios":"gcp_authn filter metadata Audience message present but its url field is unset or empty string — detected during parse() of the filter config.","commonSituations":"Management server emits Audience without url; users forget to set the audience URL for the protected backend; templated configs where the URL substitution failed.","solutions":["Set the url field in the gcp_authn Audience metadata to the audience of the target service (e.g. https://<service>.<project>.googleapis.com/).","Verify the LDS/filter-metadata JSON actually contains the URL (no empty template substitution).","Check that the control plane serializes the Audience url field correctly."],"exampleFix":"// before\n\"audience\": {}\n// after\n\"audience\": { \"url\": \"https://run.googleapis.com/\" }","handlingStrategy":"validation","validationCode":"Audience a = /* ... */;\nif (a.getUrl().isEmpty()) throw new IllegalArgumentException(\"gcp_authn audience url is required\");","typeGuard":null,"tryCatchPattern":"try { /* parse */ } catch (ResourceInvalidException e) { if (e.getMessage().contains(\"URL is empty\")) { log.error(\"Set audience.url in gcp_authn metadata\"); } }","preventionTips":["Always set the audience url for gcp_authn filter metadata","Check templates/variable substitution that could leave url empty","Add a config linter that rejects Audience messages without url"],"tags":["xds","gcp-authn","config-parsing","empty-field"],"backgroundTag":"empty-required-field","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}