gofr-dev/gofr · error

invalid URL

Error message

invalid URL

What it means

errInvalidURL is returned by getPublicKeys when the provider's URL cannot be parsed or is not a valid HTTP(S) URL. The middleware uses this URL to fetch the public key set, so an unparseable URL is rejected before any request is made.

Source

Thrown at pkg/gofr/http/middleware/oauth.go:27

	"fmt"
	"io"
	"math/big"
	"net/http"
	"regexp"
	"strings"
	"sync"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

var (
	errEmptyProvider       = errors.New("require non-empty provider")
	errInvalidInterval     = errors.New("invalid interval, require a value greater than 1 second")
	errEmptyModulus        = errors.New("modulus is empty")
	errEmptyPublicExponent = errors.New("public exponent is empty")
	errEmptyResponseBody   = errors.New("response body is empty")
	errInvalidURL          = errors.New("invalid URL")
)

const jwtRegexPattern = "^[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+$"

// PublicKeys stores a map of public keys identified by their key ID (kid).
type PublicKeys struct {
	mu   sync.RWMutex
	keys map[string]*rsa.PublicKey
}

// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).
type JWKNotFound struct {
}

func (JWKNotFound) Error() string {
	return "JWKS Not Found"
}

View on GitHub (pinned to 187eb24962)

Solutions

1. Include the full scheme in the provider URL (https://...)
2. Check the environment variable feeding the provider config is set and not blank
3. Validate the URL with url.Parse or a similar check before wiring it into the OAuth middleware

Example fix

// before
provider: "auth.example.com/certs"
// after
provider: "https://auth.example.com/certs"

u, err := url.Parse(providerURL); if err != nil || u.Scheme == "" || u.Host == "" { return fmt.Errorf("invalid provider URL: %q", providerURL) }

func isValidURL(s string) bool { u, err := url.Parse(s); return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Host != "" }

When it happens

Trigger: Setting the OAuth provider option to an empty string, a URL without scheme (e.g. 'auth.example.com'), or a string with invalid characters that url.Parse rejects.

Common situations: Copy-paste mistakes in configuration (missing https://), environment variables left unset so an empty URL is passed in, typos in provider hostnames.

Related errors

• %w: deleting document: %w
• invalid Azure configuration: share name is required
• invalid Azure configuration: account name is required
• invalid Azure configuration: account key is required
• azure config is nil

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/e212993dda1678f2. Report an issue: GitHub.