badges/shields · error · InvalidParameter

invalid url parameter

Error message

invalid url parameter

What it means

isAllowedOrigin parses the given URL with `new URL(url)`; if the URL is malformed and the constructor throws, the helper wraps it as InvalidParameter with prettyMessage 'invalid url parameter'. It is used by _getJwt (via originViolation) to authorize the JWT login endpoint against `_authorizedOrigins`, so a bad URL can never be compared against the allowlist.

Source

Thrown at core/base-service/auth-helper.js:103

    const strictSSL = options?.https?.rejectUnauthorized ?? true
    return strictSSL !== true
  }

  enforceStrictSsl({ options = {} }) {
    if (
      this._requireStrictSsl &&
      this.constructor._isInsecureSslRequest({ options })
    ) {
      throw new InvalidParameter({ prettyMessage: 'strict ssl is required' })
    }
  }

  isAllowedOrigin(url) {
    let parsed
    try {
      parsed = new URL(url)
    } catch (e) {
      throw new InvalidParameter({ prettyMessage: 'invalid url parameter' })
    }

    const { protocol, host } = parsed
    const origin = `${protocol}//${host}`
    return this._authorizedOrigins.includes(origin)
  }

  shouldAuthenticateRequest({ url, options = {} }) {
    const originViolation = !this.isAllowedOrigin(url)

    const strictSslCheckViolation =
      this._requireStrictSslToAuthenticate &&
      this.constructor._isInsecureSslRequest({ options })

    return this.isConfigured && !originViolation && !strictSslCheckViolation
  }

  get _basicAuth() {

View on GitHub (pinned to 766fd8bc89)

Solutions

1. Ensure the URL includes a valid scheme, e.g. https://host/path (use `new URL(candidate)` locally to validate first)
2. Check the config/env value feeding the URL — a missing variable often yields '' or 'undefined'
3. URL-encode spaces and illegal characters, or trim whitespace from the value
4. Validate user-supplied config at load time and reject it early with a clear message

Example fix

// before
const loginEndpoint = config.jiraServer + '/rest/oauth-token' // if config.jiraServer is undefined -> 'undefined/rest/...'
// after
if (!config.jiraServer) throw new Error('jiraServer config is required')
const loginEndpoint = `https://${new URL(config.jiraServer).host}/rest/oauth-token`

function assertValidUrl(candidate) {
  let u
  try { u = new URL(candidate) } catch { throw new Error(`invalid url parameter: ${JSON.stringify(candidate)}`) }
  if (!['http:', 'https:'].includes(u.protocol)) throw new Error('url must be http(s)')
  return u
}
assertValidUrl(loginEndpoint)

function isHttpUrl(value) {
  if (typeof value !== 'string' || value.length === 0) return false
  try { const u = new URL(value); return u.protocol === 'http:' || u.protocol === 'https:' } catch { return false }
}
if (isHttpUrl(loginEndpoint)) { /* proceed */ }

try {
  const token = await service.token({ loginEndpoint })
} catch (err) {
  if (err.prettyMessage === 'invalid url parameter') {
    // log the offending config value and fail fast with a config-fix hint
  } else throw err
}

When it happens

Trigger: Passing a non-URL string (empty string, 'selfhosted/api', 'localhost:8080/login' without scheme, URL with spaces) as the loginEndpoint/auth URL into code that reaches isAllowedOrigin — e.g. `token` on a JWT-auth helper with a misconfigured `authUrl`/config value.

Common situations: Typos or missing scheme (https://) in service config for JWT/token-based auth; environment variables or user config supplying a partial URL; template strings that resolve to empty because an upstream config key was missing.

Related errors

• strict ssl is required
• requested origin not authorized
• invalid url
• please use https
• invalid response data from auth endpoint

AI-assisted analysis of badges/shields@766fd8bc89 (2026-08-30). Data as JSON: /api/errors/45bb351de42c5f8b. Report an issue: GitHub.