deepseek-ai/deepseek-harness · error · WebError

WEB_BLOCKED_URL

WEB_BLOCKED_URL

Error message

credentials in URLs are not allowed

What it means

Error "credentials in URLs are not allowed" thrown in deepseek-ai/deepseek-harness.

Source

Thrown at packages/web/web-fetch-http/src/policy.ts:38

 * @param input - the raw URL string from the fetch request.
 * @param maxUrlLength - inclusive upper bound on `input`'s length.
 * @returns the parsed `URL`.
 */
export function validateFetchUrl(input: string, maxUrlLength: number): URL {
  if (input.length > maxUrlLength) {
    throw new WebError(`URL exceeds the maximum length of ${maxUrlLength}`, 'WEB_INVALID_URL')
  }
  let url: URL
  try {
    url = new URL(input)
  } catch (error: unknown) {
    throw new WebError(`invalid URL: ${input}`, 'WEB_INVALID_URL', { cause: error })
  }
  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
    throw new WebError(`unsupported URL scheme "${url.protocol}" (only http and https are allowed)`, 'WEB_INVALID_URL')
  }
  if (url.username.length > 0 || url.password.length > 0) {
    throw new WebError('credentials in URLs are not allowed', 'WEB_BLOCKED_URL')
  }
  return url
}

/**
 * Two URLs are same-origin when scheme, hostname, and port match. A redirect
 * that crosses origins is refused so each new origin requires a fresh tool call
 * (and thus a fresh provider/permission decision).
 *
 * @param a - one of the two URLs to compare.
 * @param b - the other URL to compare.
 * @returns true when `a` and `b` share scheme, hostname, and port.
 */
export function isSameOrigin(a: URL, b: URL): boolean {
  return a.protocol === b.protocol && a.hostname === b.hostname && a.port === b.port
}

/**

View on GitHub (pinned to b150a551b8)

Solutions

1. Remove userinfo credentials from the URL; pass credentials through headers if allowed.

When it happens

Trigger: Thrown at packages/web/web-fetch-http/src/policy.ts:38 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of deepseek-ai/deepseek-harness@b150a551b8 (2026-08-24). Data as JSON: /api/errors/8e8e65fc333f13d9. Report an issue: GitHub.