%s is an invalid address, ingress rules don't support proxyi

Error message

%s is an invalid address, ingress rules don't support proxying to a different path on the origin service. The path will be the same as the eyeball request's path

What it means

ingress rules proxy requests with the same path the eyeball used, so a service URL containing a path component is rejected. validateIngress checks u.Path after scheme/host validation and returns this error when any path is present on the origin service URL.

Source

Thrown at ingress/ingress.go:305

		} else if r.Service == ServiceBastion || cfg.BastionMode {
			// Bastion mode will always start a Websocket proxy server, which will
			// overwrite the localService.URL field when `start` is called. So,
			// leave the URL field empty for now.
			cfg.BastionMode = true
			service = newBastionService()
		} else {
			// Validate URL services
			u, err := url.Parse(r.Service)
			if err != nil {
				return Ingress{}, err
			}

			if u.Scheme == "" || u.Hostname() == "" {
				return Ingress{}, fmt.Errorf("%s is an invalid address, please make sure it has a scheme and a hostname", r.Service)
			}

			if u.Path != "" {
				return Ingress{}, fmt.Errorf("%s is an invalid address, ingress rules don't support proxying to a different path on the origin service. The path will be the same as the eyeball request's path", r.Service)
			}
			if isHTTPService(u) {
				service = &httpService{url: u}
			} else {
				service = newTCPOverWSService(u)
			}
		}

		var handlers []middleware.Handler
		if access := r.OriginRequest.Access; access != nil {
			if err := validateAccessConfiguration(access); err != nil {
				return Ingress{}, err
			}
			if access.Required {
				verifier := middleware.NewJWTValidator(access.TeamName, access.Environment, access.AudTag)
				handlers = append(handlers, verifier)
			}
		}

View on GitHub (pinned to 2253eeeb25)

Solutions

Remove the path from the service URL, keeping only scheme://host[:port]
Handle path routing via multiple ingress rules with `path` matchers instead of origin paths
If path rewriting is required, put a reverse proxy in front of the origin

Example fix

// before
service: http://localhost:8080/api
// after
service: http://localhost:8080

Defensive patterns

Strategy: validation

Validate before calling

if u, err := url.Parse(svc); err == nil && u.Path != "" {
	return fmt.Errorf("service %q must not include a path", svc)
}

Try / catch

if err := ingress.ParseIngress(cfg); err != nil {
	if strings.Contains(err.Error(), "don't support proxying to a different path") {
		// strip the path or move routing to ingress path matchers
	}
	return err
}

Prevention

Keep origin service URLs path-free
Use ingress rule `path` matchers for path-based routing
Document that path rewriting needs an external reverse proxy

When it happens

Trigger: ParseIngress/UnmarshalJSON on a service value like `http://localhost:8080/api` or `https://backend.internal/v2` — any non-empty URL path triggers the error.

Common situations: Users expecting ingress rules to rewrite paths (like a reverse proxy with prefix stripping), copying an origin URL including its base path from another proxy config.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/a3ba4701260431e1. Report an issue: GitHub.