larksuite/cli · error

invalid proxy address %q: path is not allowed

Error message

invalid proxy address %q: path is not allowed

What it means

Guard in ValidateProxyAddr: the proxy URL contains a path component; proxy addresses must be host:port only with no path.

Source

Thrown at sidecar/protocol.go:177

	if err != nil {
		return fmt.Errorf("invalid proxy address %q: %w", addr, err)
	}
	if u.User != nil {
		return fmt.Errorf("invalid proxy address %q: userinfo is not allowed", addr)
	}
	if u.Scheme == "https" {
		return fmt.Errorf("invalid proxy address %q: use http:// — sidecar is "+
			"same-host only (loopback or virtual same-host bridge), so TLS adds "+
			"no security; cross-machine deployment is out of scope", addr)
	}
	if u.Scheme != "http" {
		return fmt.Errorf("invalid proxy address %q: scheme must be http", addr)
	}
	if u.Host == "" {
		return fmt.Errorf("invalid proxy address %q: missing host", addr)
	}
	if u.Path != "" && u.Path != "/" {
		return fmt.Errorf("invalid proxy address %q: path is not allowed", addr)
	}
	// u.Hostname() strips the port and unwraps IPv6 brackets.
	if !isSameHost(u.Hostname()) {
		return errNotSameHost(addr)
	}
	return nil
}

// ProxyHost extracts the host:port from an AUTH_PROXY URL.
// Input is expected to be an HTTP URL like "http://127.0.0.1:16384".
// Returns the host:port portion for URL rewriting.
func ProxyHost(authProxy string) string {
	// Strip scheme
	host := authProxy
	if i := strings.Index(host, "://"); i >= 0 {
		host = host[i+3:]
	}
	// Strip trailing slash

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Use a bare http://host:port address without a path

When it happens

Trigger: Thrown at sidecar/protocol.go:177 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/37cc28667e1e4938. Report an issue: GitHub.