gofr-dev/gofr · error

invalid URL

Error message

invalid URL

What it means

errInvalidURL is returned by getPublicKeys when the provider's URL cannot be parsed or is not a valid HTTP(S) URL. The middleware uses this URL to fetch the public key set, so an unparseable URL is rejected before any request is made.

Solutions

1. Include the full scheme in the provider URL (https://...)
2. Check the environment variable feeding the provider config is set and not blank
3. Validate the URL with url.Parse or a similar check before wiring it into the OAuth middleware

Example fix

// before
provider: "auth.example.com/certs"
// after
provider: "https://auth.example.com/certs"

u, err := url.Parse(providerURL); if err != nil || u.Scheme == "" || u.Host == "" { return fmt.Errorf("invalid provider URL: %q", providerURL) }

func isValidURL(s string) bool { u, err := url.Parse(s); return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Host != "" }

When it happens

Trigger: Setting the OAuth provider option to an empty string, a URL without scheme (e.g. 'auth.example.com'), or a string with invalid characters that url.Parse rejects.

Common situations: Copy-paste mistakes in configuration (missing https://), environment variables left unset so an empty URL is passed in, typos in provider hostnames.

Related errors

• azure config is nil
• both username and password must be provided
• burst must be positive
• errMessage (dynamic credential validation error)
• failed to append CA certificate

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/e212993dda1678f2. Report an issue: GitHub.

Appendix: source

Thrown at pkg/gofr/http/middleware/oauth.go:27

	"fmt"
	"io"
	"math/big"
	"net/http"
	"regexp"
	"strings"
	"sync"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

var (
	errEmptyProvider       = errors.New("require non-empty provider")
	errInvalidInterval     = errors.New("invalid interval, require a value greater than 1 second")
	errEmptyModulus        = errors.New("modulus is empty")
	errEmptyPublicExponent = errors.New("public exponent is empty")
	errEmptyResponseBody   = errors.New("response body is empty")
	errInvalidURL          = errors.New("invalid URL")
)

const jwtRegexPattern = "^[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+$"

// PublicKeys stores a map of public keys identified by their key ID (kid).
type PublicKeys struct {
	mu   sync.RWMutex
	keys map[string]*rsa.PublicKey
}

// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).
type JWKNotFound struct {
}

func (JWKNotFound) Error() string {
	return "JWKS Not Found"
}

View on GitHub (pinned to 187eb24962)