hashicorp/vault · error · Error

Invalid URL

Error message

Invalid URL

What it means

Thrown by the OIDC consent screen component (ui/app/components/oidc-consent-block.js:43). After a user consents (prompt=consent flow on Vault's identity OIDC provider), the component rebuilds the redirect URL by appending query params to the redirect target using new URL(). The URL constructor throws a TypeError on input that is not an absolute, parseable URL; the component catches it, logs a console.debug with the raw value, and rethrows this generic message.

Source

Thrown at ui/app/components/oidc-consent-block.js:43

export default class OidcConsentBlockComponent extends Component {
  @tracked didCancel = false;

  get win() {
    return this.window || window;
  }

  buildUrl(urlString, params) {
    try {
      const url = new URL(urlString);
      Object.keys(params).forEach((key) => {
        if (params[key] && validParameters.includes(key)) {
          url.searchParams.append(key, params[key]);
        }
      });
      return url;
    } catch (e) {
      console.debug('DEBUG: parsing url failed for', urlString); // eslint-disable-line
      throw new Error('Invalid URL');
    }
  }

  @action
  handleSubmit(evt) {
    evt.preventDefault();
    const { redirect, ...params } = this.args;
    const redirectUrl = this.buildUrl(redirect, params);
    if (Ember.testing) {
      this.args.testRedirect(redirectUrl.toString());
    } else {
      this.win.location.replace(redirectUrl);
    }
  }

  @action
  handleCancel(evt) {
    evt.preventDefault();

View on GitHub (pinned to 744b611b57)

Solutions

1. Check the console for 'DEBUG: parsing url failed for' to see the exact malformed value
2. Fix the redirect_uri on the relying party / Vault OIDC client assignment so it is an absolute URL (https://app.example.com/callback)
3. Re-run the authorization request with the corrected redirect_uri

Example fix

// before
buildUrl(urlString, params) {
  try {
    const url = new URL(urlString);
    ...
  } catch (e) {
    throw new Error('Invalid URL');
  }
}

// after: validate early with a clear message
buildUrl(urlString, params) {
  if (!URL.canParse(urlString)) {
    throw new Error(`Invalid redirect URL: "${urlString}" is not an absolute URL.`);
  }
  const url = new URL(urlString);
  ...
}

// Validate the redirect target before building the consent URL
function isValidAbsoluteUrl(value) {
  try {
    new URL(value);
    return true;
  } catch {
    return false;
  }
}
// or on modern browsers/node: URL.canParse(value)

if (!isValidAbsoluteUrl(this.args.redirect)) {
  showError('redirect_uri must be an absolute URL');
  return;
}

try {
  const redirectUrl = this.buildUrl(redirect, params);
} catch (e) {
  if (e.message === 'Invalid URL') {
    // the console.debug line holds the raw string that failed to parse
    showError('Redirect URL is invalid — check console for the raw value and fix the client redirect_uri');
  } else {
    throw e;
  }
}

When it happens

Trigger: The redirect arg passed to the consent block (the redirect_uri originally supplied to /v1/identity/oidc/provider/<name>/authorize) is empty, relative (e.g. /callback), or otherwise malformed, so new URL(urlString) throws in buildUrl().

Common situations: The client application registered a relative or malformed redirect_uri; a reverse proxy rewrote or stripped the scheme from the callback URL; query params were lost or double-decoded in transit.

Related errors

• Invalid URL
• Missing required query params

AI-assisted analysis of hashicorp/vault@744b611b57 (2026-08-15). Data as JSON: /api/errors/6bf47cf17efabb87. Report an issue: GitHub.