ory/hydra · error

ErrUnknownScheme

ErrUnknownScheme

Error message

unknown scheme in source: 

What it means

Returned by FetchBytes when the source string matches none of the allowed schemes (http://, https://, file://, base64://, inline passthrough). The scheme is not on the fetcher's allow-list, so the source is rejected before any I/O happens.

Source

Thrown at oryx/fetcher/fetcher.go:140

		return nil, errors.WithStack(fmt.Errorf("%w: in source %q: allowed schemes: %s", ErrUnknownScheme, redactedSource(source), strings.Join(f.schemes, ", ")))
	}
	switch {
	case strings.HasPrefix(source, "http://"), strings.HasPrefix(source, "https://"):
		return f.fetchRemote(ctx, source)
	case strings.HasPrefix(source, "file://"):
		b, err := os.ReadFile(strings.TrimPrefix(source, "file://"))
		if err != nil {
			return nil, errors.Wrapf(err, "read file: %s", redactedSource(source))
		}
		return b, nil
	case strings.HasPrefix(source, "base64://"):
		src, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(source, "base64://"))
		if err != nil {
			return nil, errors.Wrapf(err, "base64decode: %s", redactedSource(source))
		}
		return src, nil
	default:
		return nil, errors.Wrap(ErrUnknownScheme, "unknown scheme in source: "+redactedSource(source))
	}
}

func (f *Fetcher) fetchRemote(ctx context.Context, source string) (b []byte, err error) {
	if f.cache != nil {
		cacheKey := sha256.Sum256([]byte(source))
		if v, ok := f.cache.Get(cacheKey[:]); ok {
			b = make([]byte, len(v))
			copy(b, v)
			return b, nil
		}
		defer func() {
			if err == nil && len(b) > 0 {
				toCache := make([]byte, len(b))
				copy(toCache, b)
				f.cache.SetWithTTL(cacheKey[:], toCache, int64(len(toCache)), f.ttl)
			}
		}()

View on GitHub (pinned to 4174065ffb)

Solutions

1. Use one of the allowed scheme prefixes: http://, https://, file://, or base64://
2. Extend the fetcher's allowed schemes configuration if the scheme is legitimately needed
3. Check the source string for a missing or mistyped scheme prefix

When it happens

Trigger: Thrown at oryx/fetcher/fetcher.go:140 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/90bb9b6a2c02f56d. Report an issue: GitHub.