{"record":{"id":"e212993dda1678f2","repo":"gofr-dev/gofr","slug":"invalid-url","errorCode":null,"errorMessage":"invalid URL","messagePattern":"invalid URL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/http/middleware/oauth.go","lineNumber":27,"sourceCode":"\t\"fmt\"\n\t\"io\"\n\t\"math/big\"\n\t\"net/http\"\n\t\"regexp\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/golang-jwt/jwt/v5\"\n)\n\nvar (\n\terrEmptyProvider       = errors.New(\"require non-empty provider\")\n\terrInvalidInterval     = errors.New(\"invalid interval, require a value greater than 1 second\")\n\terrEmptyModulus        = errors.New(\"modulus is empty\")\n\terrEmptyPublicExponent = errors.New(\"public exponent is empty\")\n\terrEmptyResponseBody   = errors.New(\"response body is empty\")\n\terrInvalidURL          = errors.New(\"invalid URL\")\n)\n\nconst jwtRegexPattern = \"^[A-Za-z0-9-_]+\\\\.[A-Za-z0-9-_]+\\\\.[A-Za-z0-9-_]+$\"\n\n// PublicKeys stores a map of public keys identified by their key ID (kid).\ntype PublicKeys struct {\n\tmu   sync.RWMutex\n\tkeys map[string]*rsa.PublicKey\n}\n\n// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).\ntype JWKNotFound struct {\n}\n\nfunc (JWKNotFound) Error() string {\n\treturn \"JWKS Not Found\"\n}\n","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/http/middleware/oauth.go#L9-L45","documentation":"errInvalidURL is returned by getPublicKeys when the provider's URL cannot be parsed or is not a valid HTTP(S) URL. The middleware uses this URL to fetch the public key set, so an unparseable URL is rejected before any request is made.","triggerScenarios":"Setting the OAuth provider option to an empty string, a URL without scheme (e.g. 'auth.example.com'), or a string with invalid characters that url.Parse rejects.","commonSituations":"Copy-paste mistakes in configuration (missing https://), environment variables left unset so an empty URL is passed in, typos in provider hostnames.","solutions":["Include the full scheme in the provider URL (https://...)","Check the environment variable feeding the provider config is set and not blank","Validate the URL with url.Parse or a similar check before wiring it into the OAuth middleware"],"exampleFix":"// before\nprovider: \"auth.example.com/certs\"\n// after\nprovider: \"https://auth.example.com/certs\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(providerURL); if err != nil || u.Scheme == \"\" || u.Host == \"\" { return fmt.Errorf(\"invalid provider URL: %q\", providerURL) }","typeGuard":"func isValidURL(s string) bool { u, err := url.Parse(s); return err == nil && (u.Scheme == \"http\" || u.Scheme == \"https\") && u.Host != \"\" }","tryCatchPattern":null,"preventionTips":["Always include the https:// scheme in provider config","Fail fast at startup if the provider env var is empty or malformed","Use config validation at load time, not at request time"],"tags":["oauth","url","configuration"],"backgroundTag":"invalid-url-config","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}