internal error constructing HTTP HEAD request: %v

Error message

internal error constructing HTTP HEAD request: %v

What it means

Returned by runGitAuth when `http.NewRequest("HEAD", parsedPrefix, nil)` fails. http.NewRequest only errors on a bad method or a URL that url.Parse rejects; for an https URL that has already been prefix-validated against the request, this is effectively an internal/defensive failure. In practice it indicates parsedPrefix contains characters url.Parse rejects despite passing the earlier HasPrefix check.

Source

Thrown at src/cmd/go/internal/auth/gitauth.go:62

	}
	cmd := exec.Command("git", "credential", "fill")
	cmd.Dir = dir
	cmd.Stdin = strings.NewReader(fmt.Sprintf("url=%s\n", url))
	out, err := cmd.CombinedOutput()
	if err != nil {
		return "", nil, fmt.Errorf("'git credential fill' failed (url=%s): %w\n%s", url, err, out)
	}
	parsedPrefix, username, password := parseGitAuth(out)
	if parsedPrefix == "" {
		return "", nil, fmt.Errorf("'git credential fill' failed for url=%s, could not parse url\n", url)
	}
	// Check that the URL Git gave us is a prefix of the one we requested.
	if !strings.HasPrefix(url, parsedPrefix) {
		return "", nil, fmt.Errorf("requested a credential for %s, but 'git credential fill' provided one for %s\n", url, parsedPrefix)
	}
	req, err := http.NewRequest("HEAD", parsedPrefix, nil)
	if err != nil {
		return "", nil, fmt.Errorf("internal error constructing HTTP HEAD request: %v\n", err)
	}
	req.SetBasicAuth(username, password)
	// Asynchronously validate the provided credentials using a HEAD request,
	// allowing the git credential helper to update its cache without blocking.
	// This avoids repeatedly prompting the user for valid credentials.
	// This is a best-effort update; the primary validation will still occur
	// with the caller's client.
	// The request is intercepted for testing purposes to simulate interactions
	// with the credential helper.
	intercept.Request(req)
	go updateGitCredentialHelper(client, req, out)

	// Return the parsed prefix and headers, even if credential validation fails.
	// The caller is responsible for the primary validation.
	return parsedPrefix, req.Header, nil
}

// parseGitAuth parses the output of 'git credential fill', extracting

View on GitHub (pinned to b6b368adc5)

Solutions

Report as a Go issue, attaching the `git credential fill` output (redact secrets).
If maintaining a fork, sanitize parsedPrefix (e.g. strip control chars) before constructing the request.

Defensive patterns

Strategy: validation

Prevention

This is an internal/defensive error; not expected for end users.
If encountered, report a Go issue with the (redacted) git credential output.

When it happens

Trigger: parsedPrefix is a non-empty string that nonetheless fails url.Parse (e.g. contains control characters, invalid percent-encoding, or whitespace). Near-impossible given git output was already validated.

Common situations: Not expected for end users. Would indicate a bug in parseGitAuth producing a malformed prefix, or git output with unusual control characters.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/d52029b158535f70. Report an issue: GitHub.