cloudflare/cloudflared · error

failed to create app info request

Error message

failed to create app info request

What it means

This error wraps a failure from http.NewRequest("HEAD", reqURL, nil) inside fetchMetadataJWT, used by GetAppInfo to discover the Access application protecting a URL. http.NewRequest only fails on malformed input — an unparseable URL or invalid method — so this indicates the caller-supplied reqURL is not a valid URL. The error carries the underlying url.Parse failure.

Source

Thrown at token/token.go:489

		AppAUD:      claims.AUD,
		AppHostname: appHostname,
	}, nil
}

// fetchMetadataJWT sends a HEAD request to reqURL with the metadata request
// header and returns the raw JWT string from the response. No redirects are
// followed.
func fetchMetadataJWT(reqURL string) (string, error) {
	client := &http.Client{
		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
			return http.ErrUseLastResponse
		},
		Timeout: time.Second * 7,
	}

	req, err := http.NewRequest("HEAD", reqURL, nil)
	if err != nil {
		return "", errors.Wrap(err, "failed to create app info request")
	}
	req.Header.Set(accessMetadataReqHeader, accessMetadataReqValue)
	req.Header.Set(userAgentHeader, userAgent)

	resp, err := client.Do(req) // nolint: gosec
	if err != nil {
		return "", errors.Wrap(err, "failed to get app info")
	}
	_ = resp.Body.Close()

	rawJWT := resp.Header.Get(accessMetadataRespHeader)
	if rawJWT == "" {
		return "", fmt.Errorf("failed to find Access application at %s", reqURL)
	}
	return rawJWT, nil
}

func validateMetadataIssuedAt(iat int64, now time.Time) error {

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Ensure reqURL includes an absolute scheme, e.g. https://app.example.com, not app.example.com
2. Trim whitespace/control characters from the URL before calling GetAppInfo
3. Validate with net/url.ParseRequestURI in caller code before invoking
4. If building from user input, URL-encode path/query components

Example fix

// before: passing a bare hostname
info, err := token.GetAppInfo(ctx, "app.example.com", log)
// after
reqURL := "app.example.com"
if _, err := url.ParseRequestURI("https://" + strings.TrimPrefix(reqURL, "https://")); err == nil {
	info, err = token.GetAppInfo(ctx, "https://"+reqURL, log)
}

u, err := url.ParseRequestURI(reqURL)
if err != nil || u.Scheme == "" || u.Host == "" {
	return fmt.Errorf("invalid app URL %q: must be absolute (https://host)", reqURL)
}

appInfo, err := GetAppInfo(ctx, reqURL, log)
if err != nil && strings.Contains(err.Error(), "failed to create app info request") {
	// reqURL was malformed; fix input before retry
}

When it happens

Trigger: GetAppInfo / fetchMetadataJWT is called with a reqURL that fails url parsing — e.g. missing scheme ("example.com" instead of "https://example.com"), control characters in the URL, or a completely malformed string passed from CLI flags or config.

Common situations: User passes a hostname without https:// to cloudflared access, whitespace or stray characters in a configured URL, or programmatically constructed URLs missing the scheme component.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• failed to create app token request
• not a valid host
• no input provided
• failed to parse Host
• invalid Host provided

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/28deacf2d072b282. Report an issue: GitHub.