flarum/framework · error · ValidationException

Provided avatar URL must have scheme http or https. Scheme…

Error message

Provided avatar URL must have scheme http or https. Scheme provided was $scheme.

What it means

Second guard in UserResource::assertValidAvatarUrl: the URL passed active_url validation but parse_url reports a scheme other than http or https (e.g. file:, ftp:, data:). Only http/https remote images may be fetched for avatar processing, so the request is rejected to prevent fetching from disallowed schemes (SSRF-style protection).

Solutions

1. Provide the avatar URL with an explicit http:// or https:// scheme
2. Do not use file://, ftp://, data: or other scheme URLs for remote avatar upload
3. Keep client-side URL validation consistent by requiring http(s) before submitting

When it happens

Trigger: Thrown at framework/core/src/Api/Resource/UserResource.php:519 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/7b4ea1f8b2f0fc2c. Report an issue: GitHub.

Appendix: source

Thrown at framework/core/src/Api/Resource/UserResource.php:519

    /**
     * @throws ValidationException
     */
    private function assertValidAvatarUrl(string $url): void
    {
        $urlValidator = $this->validation->make(compact('url'), [
            'url' => 'required|active_url',
        ]);

        if ($urlValidator->fails()) {
            throw new ValidationException([
                'avatar_url' => 'Provided avatar URL must be a valid URI.',
            ]);
        }

        $scheme = parse_url($url, PHP_URL_SCHEME);

        if (! in_array($scheme, ['http', 'https'])) {
            throw new ValidationException([
                'avatar_url' => "Provided avatar URL must have scheme http or https. Scheme provided was $scheme.",
            ]);
        }
    }

    private function readAvatarFromUrl(string $url): ?\Intervention\Image\Interfaces\ImageInterface
    {
        $contents = $this->retrieveAvatarFromUrl($url);

        if ($contents === null || ! $this->withinMaxResolution($contents)) {
            return null;
        }

        return $this->imageManager->read($contents);
    }

    private function retrieveAvatarFromUrl(string $url): ?string
    {

View on GitHub (pinned to 4b939f6853)