bytebase/bytebase · error

%s must have a host: %s

Error message

%s must have a host: %s

What it means

validateRemoteURL rejects URLs whose Host portion is empty, i.e. strings without an authority like "/path" or "https:///path". A URL must name a concrete host from which keys or configuration can be fetched.

Source

Thrown at backend/plugin/idp/wif/jwks.go:130

func ValidateIssuerURL(issuerURL string) error {
	return validateRemoteURL(issuerURL, "issuer URL")
}

// ValidateJWKSURL validates that the JWKS URL is a valid HTTPS URL.
func ValidateJWKSURL(jwksURL string) error {
	return validateRemoteURL(jwksURL, "JWKS URL")
}

func validateRemoteURL(rawURL, label string) error {
	parsed, err := url.Parse(rawURL)
	if err != nil {
		return errors.Wrapf(err, "invalid %s", label)
	}
	if parsed.Scheme != "https" {
		return errors.Errorf("%s must use HTTPS: %s", label, rawURL)
	}
	if parsed.Host == "" {
		return errors.Errorf("%s must have a host: %s", label, rawURL)
	}
	// Prevent localhost and private IPs in production (basic SSRF prevention)
	host := strings.ToLower(parsed.Hostname())
	if host == "localhost" || strings.HasPrefix(host, "127.") || strings.HasPrefix(host, "10.") ||
		strings.HasPrefix(host, "192.168.") || strings.HasPrefix(host, "172.") {
		return errors.Errorf("%s cannot be a private address: %s", label, rawURL)
	}
	return nil
}

func fetchOIDCConfig(ctx context.Context, configURL string) (*oidcConfig, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, configURL, nil)
	if err != nil {
		return nil, errors.Wrap(err, "failed to create request")
	}

	resp, err := httpClient.Do(req)
	if err != nil {

View on GitHub (pinned to 1870550677)

Solutions

1. Add the full authority to the URL: https://<host>/<path>.
2. Verify the host portion of the config value — it must be non-empty after the scheme and //.
3. Check that any env/secret variable supplying the hostname is actually set and non-empty.
4. Re-enter the URL from the provider's documentation verbatim.

Example fix

// before
jwksURL: "https:///jwks" // empty host
// after
jwksURL: fmt.Sprintf("https://%s/jwks", cfg.IDPHost)

u, err := url.Parse(raw)
if err != nil || u.Host == "" {
    return fmt.Errorf("remote URL must include a host")
}

null

if err := ValidateJWKSURL(raw); err != nil {
    return fmt.Errorf("JWKS URL rejected: %w", err)
}

When it happens

Trigger: Calling ValidateIssuerURL or ValidateJWKSURL with a URL that has no host component — only a path, or a scheme followed by an empty authority.

Common situations: Config field left as just a path ("/jwks"); template substitution leaving "https:///jwks" because the host variable was empty; truncated paste losing the domain part.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• invalid %s
• issuer_url is required for OIDC
• naming_payload is required for this rule
• naming_payload is required for this rule
• number_payload is required for this rule

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/168eed00af1aaad3. Report an issue: GitHub.