cloudflare/cloudflared · error

invalid Host provided

Error message

invalid Host provided

What it means

parseURL validates the host with httpguts.ValidHostHeader after Punycode conversion. If the host contains characters that are not legal in an HTTP Host header (spaces, control characters, invalid unicode, forbidden symbols), this error is returned. The URL parsed but its hostname cannot be used as a valid Access origin host.

Source

Thrown at cmd/cloudflared/access/validation.go:71

		input = fmt.Sprintf("https://%s", input)
	}
	input = bracketBareIPv6(input)
	url, err := url.ParseRequestURI(input)
	if err != nil {
		return nil, fmt.Errorf("failed to parse as URL: %w", err)
	}
	if url.Scheme != "https" {
		url.Scheme = "https"
	}
	if url.Host == "" {
		return nil, errors.New("failed to parse Host")
	}
	host, err := httpguts.PunycodeHostPort(url.Host)
	if err != nil || host == "" {
		return nil, err
	}
	if !httpguts.ValidHostHeader(host) {
		return nil, errors.New("invalid Host provided")
	}
	url.Host = host
	return url, nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Remove illegal characters (spaces, control chars) from the hostname.
2. Use punycode (xn--) form for internationalized hostnames if plain unicode fails.
3. Trim whitespace: `TARGET=$(echo "$TARGET" | tr -d '[:space:]')` before invoking.
4. Confirm the application hostname in Zero Trust matches what you pass.

Example fix

# before
cloudflared access ssh "my app.example.com"
# after
cloudflared access ssh "my-app.example.com"

import "golang.org/x/net/idna"
func validHost(h string) bool {
    h = strings.TrimSpace(h)
    if h == "" || strings.ContainsAny(h, " \t\r\n") { return false }
    _, err := idna.Lookup.ToASCII(h)
    return err == nil
}

url, err := parseURL(raw)
if err != nil {
    if strings.Contains(err.Error(), "invalid Host provided") {
        return fmt.Errorf("hostname %q contains characters invalid for a Host header", raw)
    }
    return err
}

When it happens

Trigger: Passing hosts with spaces, commas, control characters, or invalid IDN input that PunycodeHostPort cannot convert — e.g. `cloudflared access ssh "my app.example.com"` or hosts with underscores/odd symbols depending on validation rules.

Common situations: Copy-pasted URLs with trailing spaces or invisible characters; misconfigured DNS names with illegal characters; non-ASCII hostnames that fail punycode conversion.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• not a valid host
• no input provided
• failed to parse Host
• %s is not a valid URL
• %s doesn't have a hostname, consider adding a scheme

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/0d2862f2b43cf716. Report an issue: GitHub.