kestra-io/kestra · error · IllegalArgumentException

Digest authentication requires an absolute URI with a host.

Error message

Digest authentication requires an absolute URI with a host.

What it means

Thrown by the Kestra HTTP client when digest authentication is configured but the request URI lacks a host. Digest auth needs an absolute URI to build the AuthScope (host + port); if request.getUri() is null or its host is null, IllegalArgumentException is thrown. Note: this fires only after the credential guard passes.

Source

Thrown at core/src/main/java/io/kestra/core/http/client/HttpClient.java:483

        if (eventConsumer != null) {
            eventConsumer.accept(event);
        }
    }

    private HttpClientContext clientContext(HttpRequest request) throws IllegalVariableEvaluationException {
        HttpClientContext httpClientContext = ContextBuilder.create().build();

        if (this.configuration.getAuth() instanceof DigestAuthConfiguration digestAuthConfiguration) {
            String username = runContext.render(digestAuthConfiguration.getUsername()).as(String.class).orElse(null);
            String password = runContext.render(digestAuthConfiguration.getPassword()).as(String.class).orElse(null);

            if (StringUtils.isEmpty(username) || password == null) {
                throw new IllegalArgumentException("Digest authentication requires both `username` and `password`.");
            }

            URI uri = request.getUri();
            if (uri == null || uri.getHost() == null) {
                throw new IllegalArgumentException("Digest authentication requires an absolute URI with a host.");
            }

            int port = uri.getPort() != -1 ? uri.getPort() : ("https".equalsIgnoreCase(uri.getScheme()) ? 443 : 80);
            AuthScope digestScope = new AuthScope(uri.getHost(), port);
            UsernamePasswordCredentials digestCredentials = new UsernamePasswordCredentials(username, password.toCharArray());

            httpClientContext.setCredentialsProvider((authScope, context) ->
            {
                if (digestScope.match(authScope) >= 0) {
                    return digestCredentials;
                }
                return this.defaultCredentialsProvider.getCredentials(authScope, context);
            });
        }

        return httpClientContext;
    }

View on GitHub (pinned to 823fada927)

Solutions

Use an absolute URI with a scheme and host (https://example.com/path).
If the URI is templated, ensure the rendered expression yields a full URL.
Set a base URI on the request/task if the path is relative.
Validate the rendered URI in a debug step before the HTTP call.

Example fix

# before (relative URI)
uri: "/api/v1/users"
# after (absolute URI)
uri: "https://example.com/api/v1/users"

Defensive patterns

Strategy: validation

Validate before calling

URI uri = request.getUri();
if (uri == null || uri.getHost() == null) {
  throw new IllegalStateException('Digest auth requires an absolute URI with a host');
}

Try / catch

try {
  // build AuthScope from uri host/port
} catch (IllegalArgumentException e) {
  if (e.getMessage().contains('absolute URI')) {
    log.error('Configure an absolute URI for digest-auth requests');
  }
  throw e;
}

Prevention

Use absolute URIs (scheme + host) for digest-auth requests.
Validate templated URIs render to full URLs.
Set a base URI when the path is relative.

When it happens

Trigger: Digest auth configured; username/password both present; request.getUri() returns null OR uri.getHost() is null; the guard throws IllegalArgumentException.

Common situations: URI is relative (e.g. '/api/x') instead of absolute, the URI scheme/host is built from an expression that rendered empty, a malformed URI string, or the base URL was not set for a templated request.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of kestra-io/kestra@823fada927 (2026-08-14). Data as JSON: /api/errors/dd3ca32e76bf0329. Report an issue: GitHub.