hashicorp/vault · error · Error

Invalid URL

Error message

Invalid URL

What it means

Thrown by the OIDC provider route (ui/app/routes/vault/cluster/oidc-provider.js:90) in _buildUrl(), which reconstructs URLs from the browser origin or the authorize flow's base URL by appending query params via new URL(). If the URL string is malformed the URL constructor throws, the route logs a console.debug with the raw value, and rethrows this generic message.

Source

Thrown at ui/app/routes/vault/cluster/oidc-provider.js:90

    };
    if (namespace) {
      queryParams.namespace = namespace;
    }
    return this.router.transitionTo(AUTH, cluster_name, { queryParams });
  }

  _buildUrl(urlString, params) {
    try {
      const url = new URL(urlString);
      Object.keys(params).forEach((key) => {
        if (params[key]) {
          url.searchParams.append(key, params[key]);
        }
      });
      return url;
    } catch (e) {
      console.debug('DEBUG: parsing url failed for', urlString); // eslint-disable-line
      throw new Error('Invalid URL');
    }
  }

  _handleSuccess(response, baseUrl, state) {
    const { code } = response;
    const redirectUrl = this._buildUrl(baseUrl, { code, state });
    if (!Ember.testing) {
      this.win.location.replace(redirectUrl);
    }
    return { redirectUrl };
  }
  _handleError(errorResp, baseUrl) {
    const redirectUrl = this._buildUrl(baseUrl, { ...errorResp });
    if (!Ember.testing) {
      this.win.location.replace(redirectUrl);
    }
    return { redirectUrl };
  }

View on GitHub (pinned to 744b611b57)

Solutions

1. Check the console for 'DEBUG: parsing url failed for' to see the raw malformed URL string
2. Correct the redirect_uri in the client application / Vault OIDC client assignment so it is an absolute URL
3. Retest the full /v1/identity/oidc/provider/<name>/authorize flow with the fixed redirect_uri

function isValidAbsoluteUrl(value: string | undefined): value is string {
  return typeof value === 'string' && URL.canParse(value);
}

const url = isValidAbsoluteUrl(baseUrl) ? new URL(baseUrl) : fallbackToErrorPage(baseUrl);

try {
  const redirectUrl = this._buildUrl(baseUrl, { code, state });
} catch (e) {
  if (e.message === 'Invalid URL') {
    // the console.debug entry shows the exact failing string — log it server-side too
    reportMalformedRedirect(baseUrl);
    renderError('OIDC redirect target is not a valid absolute URL');
  } else {
    throw e;
  }
}

When it happens

Trigger: _handleSuccess/_handleError building the redirect back to the relying party when the redirect target or base URL string is not parseable (empty, relative, or corrupted).

Common situations: The relying party's redirect_uri is relative or malformed; a proxy or middleware rewrites headers/query strings in a way that corrupts the URL between /authorize and the callback.

Related errors

• Invalid URL
• Password reset is not available for the current user.
• Missing required query params
• Given param is not a supported tool action

AI-assisted analysis of hashicorp/vault@744b611b57 (2026-08-15). Data as JSON: /api/errors/e6fbf051a21040d0. Report an issue: GitHub.