oauth2-proxy/oauth2-proxy · error

could not parse %s URL: %v

Error message

could not parse %s URL: %v

What it means

newProviderDataFromConfig parses each provider URL field (RedeemURL, LoginURL, ProfileURL, ValidateURL, ProtectedResource, etc.) with net/url.Parse and accumulates failures as "could not parse %s URL: %v". It signals a provider option URL string is not a valid absolute URL. All failures are collected and returned together.

Source

Thrown at providers/providers.go:138

			p.SupportedCodeChallengeMethods = pkce.CodeChallengeAlgs
		}
	}

	errs := []error{}
	for name, u := range map[string]struct {
		dst **url.URL
		raw string
	}{
		"login":    {dst: &p.LoginURL, raw: providerConfig.LoginURL},
		"redeem":   {dst: &p.RedeemURL, raw: providerConfig.RedeemURL},
		"profile":  {dst: &p.ProfileURL, raw: providerConfig.ProfileURL},
		"validate": {dst: &p.ValidateURL, raw: providerConfig.ValidateURL},
		"resource": {dst: &p.ProtectedResource, raw: providerConfig.ProtectedResource},
	} {
		var err error
		*u.dst, err = url.Parse(u.raw)
		if err != nil {
			errs = append(errs, fmt.Errorf("could not parse %s URL: %v", name, err))
		}
	}
	// handle LoginURLParameters
	errs = append(errs, p.compileLoginParams(providerConfig.LoginURLParameters)...)

	if len(errs) > 0 {
		return nil, k8serrors.NewAggregate(errs)
	}

	// Make the OIDC options available to all providers that support it
	p.AllowUnverifiedEmail = ptr.Deref(providerConfig.OIDCConfig.InsecureAllowUnverifiedEmail, options.DefaultInsecureAllowUnverifiedEmail)
	p.EmailClaim = providerConfig.OIDCConfig.EmailClaim
	p.GroupsClaim = providerConfig.OIDCConfig.GroupsClaim
	p.SkipClaimsFromProfileURL = ptr.Deref(providerConfig.SkipClaimsFromProfileURL, options.DefaultSkipClaimsFromProfileURL)

	// Set PKCE enabled or disabled based on discovery and force options
	p.CodeChallengeMethod = parseCodeChallengeMethod(providerConfig)
	if len(p.SupportedCodeChallengeMethods) != 0 && p.CodeChallengeMethod == "" {

View on GitHub (pinned to 33c2eb92de)

Solutions

1. Identify which URL field failed from the %s name in the message and inspect the raw configured value for spaces/newlines/control chars.
2. Trim whitespace and ensure the value is a well-formed URL with scheme, e.g. https://provider.example.com/oauth/redeem.
3. If the value comes from a flag/env/file, verify the env var is expanded (no literal ${VAR} left) and shell quoting is correct.
4. Validate URLs before deployment with a quick Go/python url-parse check or by running oauth2-proxy with --provider debug startup.

Example fix

// before
redeemURL: "https://sso.example.com/oauth/redeem\n"
// after
redeemURL: "https://sso.example.com/oauth/redeem"

for name, raw := range map[string]string{"redeem": redeemURL, "login": loginURL, "profile": profileURL, "validate": validateURL} {
    if _, err := url.Parse(strings.TrimSpace(raw)); err != nil {
        return fmt.Errorf("provider %s URL invalid: %v", name, err)
    }
}

if _, err := url.Parse(raw); err != nil {
    return fmt.Errorf("invalid %s URL %q: %w", name, raw, err)
}

When it happens

Trigger: Any provider config where providerConfig.RedeemURL / LoginURL / ProfileURL / ValidateURL / ProtectedResource (or the specific field named in the message) fails url.Parse — e.g. contains spaces, control characters, a bare hostname without scheme is actually parseable but malformed ones like "http://exa mple.com" or "::bad::" fail.

Common situations: Copy-pasted URLs with trailing spaces or newlines from YAML; unescaped special characters (|, # misuse) in flags; template/secret placeholders left unexpanded (e.g. "${REDEEM_URL}"); shell quoting issues when passing URLs as CLI flags.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• secret source is invalid: exactly one entry required, specif
• error converting upstreams: %v
• could not parse upstream %q: %v
• unknown extension: %q, supported extensions are .svg, .jpg,
• htpasswd entries error: %v

AI-assisted analysis of oauth2-proxy/oauth2-proxy@33c2eb92de (2026-09-06). Data as JSON: /api/errors/ec1803e7b7f5c002. Report an issue: GitHub.