{"record":{"id":"e6fbf051a21040d0","repo":"hashicorp/vault","slug":"invalid-url-e6fbf0","errorCode":null,"errorMessage":"Invalid URL","messagePattern":"Invalid URL","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ui/app/routes/vault/cluster/oidc-provider.js","lineNumber":90,"sourceCode":"    };\n    if (namespace) {\n      queryParams.namespace = namespace;\n    }\n    return this.router.transitionTo(AUTH, cluster_name, { queryParams });\n  }\n\n  _buildUrl(urlString, params) {\n    try {\n      const url = new URL(urlString);\n      Object.keys(params).forEach((key) => {\n        if (params[key]) {\n          url.searchParams.append(key, params[key]);\n        }\n      });\n      return url;\n    } catch (e) {\n      console.debug('DEBUG: parsing url failed for', urlString); // eslint-disable-line\n      throw new Error('Invalid URL');\n    }\n  }\n\n  _handleSuccess(response, baseUrl, state) {\n    const { code } = response;\n    const redirectUrl = this._buildUrl(baseUrl, { code, state });\n    if (!Ember.testing) {\n      this.win.location.replace(redirectUrl);\n    }\n    return { redirectUrl };\n  }\n  _handleError(errorResp, baseUrl) {\n    const redirectUrl = this._buildUrl(baseUrl, { ...errorResp });\n    if (!Ember.testing) {\n      this.win.location.replace(redirectUrl);\n    }\n    return { redirectUrl };\n  }","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/hashicorp/vault/blob/744b611b5700b3b7f82d76b4d6938a91b9989367/ui/app/routes/vault/cluster/oidc-provider.js#L72-L108","documentation":"Thrown by the OIDC provider route (ui/app/routes/vault/cluster/oidc-provider.js:90) in _buildUrl(), which reconstructs URLs from the browser origin or the authorize flow's base URL by appending query params via new URL(). If the URL string is malformed the URL constructor throws, the route logs a console.debug with the raw value, and rethrows this generic message.","triggerScenarios":"_handleSuccess/_handleError building the redirect back to the relying party when the redirect target or base URL string is not parseable (empty, relative, or corrupted).","commonSituations":"The relying party's redirect_uri is relative or malformed; a proxy or middleware rewrites headers/query strings in a way that corrupts the URL between /authorize and the callback.","solutions":["Check the console for 'DEBUG: parsing url failed for' to see the raw malformed URL string","Correct the redirect_uri in the client application / Vault OIDC client assignment so it is an absolute URL","Retest the full /v1/identity/oidc/provider/<name>/authorize flow with the fixed redirect_uri"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function isValidAbsoluteUrl(value: string | undefined): value is string {\n  return typeof value === 'string' && URL.canParse(value);\n}\n\nconst url = isValidAbsoluteUrl(baseUrl) ? new URL(baseUrl) : fallbackToErrorPage(baseUrl);","typeGuard":null,"tryCatchPattern":"try {\n  const redirectUrl = this._buildUrl(baseUrl, { code, state });\n} catch (e) {\n  if (e.message === 'Invalid URL') {\n    // the console.debug entry shows the exact failing string — log it server-side too\n    reportMalformedRedirect(baseUrl);\n    renderError('OIDC redirect target is not a valid absolute URL');\n  } else {\n    throw e;\n  }\n}","preventionTips":["Register only absolute callback URLs on relying parties","Log the raw failing URL string (as the console.debug does) when this fires — the generic message alone is not diagnosable"],"tags":["oidc","url-parsing","redirect-uri","routing"],"backgroundTag":null,"analyzedSha":"744b611b5700b3b7f82d76b4d6938a91b9989367","analyzedAt":"2026-08-15T14:40:29.333Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}