grpc/grpc-java · error · ResourceInvalidException

Audience URL is empty. Metadata value must contain a valid U

Error message

Audience URL is empty. Metadata value must contain a valid URL.

What it means

After successfully unpacking the Audience proto, GcpAuthenticationFilter's AudienceWrapper.parse validates that audience.getUrl() is non-empty; if empty it throws ResourceInvalidException 'Audience URL is empty. Metadata value must contain a valid URL.'. The gcp_authn filter needs a target audience URL to fetch GCP identity tokens.

Source

Thrown at xds/src/main/java/io/grpc/xds/GcpAuthenticationFilter.java:324

      }
    }

    @Override
    public String getTypeUrl() {
      return "type.googleapis.com/envoy.extensions.filters.http.gcp_authn.v3.Audience";
    }

    @Override
    public AudienceWrapper parse(Any any) throws ResourceInvalidException {
      Audience audience;
      try {
        audience = any.unpack(Audience.class);
      } catch (InvalidProtocolBufferException ex) {
        throw new ResourceInvalidException("Invalid Resource in address proto", ex);
      }
      String url = audience.getUrl();
      if (url.isEmpty()) {
        throw new ResourceInvalidException(
            "Audience URL is empty. Metadata value must contain a valid URL.");
      }
      return new AudienceWrapper(url);
    }
  }
}

View on GitHub (pinned to 64daddc1f3)

Solutions

Set the url field in the gcp_authn Audience metadata to the audience of the target service (e.g. https://<service>.<project>.googleapis.com/).
Verify the LDS/filter-metadata JSON actually contains the URL (no empty template substitution).
Check that the control plane serializes the Audience url field correctly.

Example fix

// before
"audience": {}
// after
"audience": { "url": "https://run.googleapis.com/" }

Defensive patterns

Strategy: validation

Validate before calling

Audience a = /* ... */;
if (a.getUrl().isEmpty()) throw new IllegalArgumentException("gcp_authn audience url is required");

Try / catch

try { /* parse */ } catch (ResourceInvalidException e) { if (e.getMessage().contains("URL is empty")) { log.error("Set audience.url in gcp_authn metadata"); } }

Prevention

Always set the audience url for gcp_authn filter metadata
Check templates/variable substitution that could leave url empty
Add a config linter that rejects Audience messages without url

When it happens

Trigger: gcp_authn filter metadata Audience message present but its url field is unset or empty string — detected during parse() of the filter config.

Common situations: Management server emits Audience without url; users forget to set the audience URL for the protected backend; templated configs where the URL substitution failed.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/df08ae82ec53f8e0. Report an issue: GitHub.