pinpoint-apm/pinpoint · error · IllegalArgumentException

Webhook URL scheme must be http or https

Error message

Webhook URL scheme must be http or https

What it means

WebhookUrlValidator.validateScheme throws IllegalArgumentException when the URL scheme is present but is neither http nor https (case-insensitive). The validator only permits HTTP(S) webhook targets for security reasons.

Source

Thrown at commons-server/src/main/java/com/navercorp/pinpoint/common/server/webhook/WebhookUrlValidator.java:114

        } catch (URISyntaxException e) {
            throw new IllegalArgumentException("Malformed webhook URL", e);
        }

        validateScheme(uri);
        validateAuthority(uri);

        return uri;
    }

    private static void validateScheme(URI uri) {
        String scheme = uri.getScheme();
        if (scheme == null) {
            throw new IllegalArgumentException("Webhook URL scheme is required");
        }

        String normalizedScheme = scheme.toLowerCase(Locale.ROOT);
        if (!"http".equals(normalizedScheme) && !"https".equals(normalizedScheme)) {
            throw new IllegalArgumentException("Webhook URL scheme must be http or https");
        }
    }

    private static void validateAuthority(URI uri) {
        if (uri.getHost() == null || uri.getHost().isBlank()) {
            throw new IllegalArgumentException("Webhook URL host is required");
        }
        if (isBlockedHostLiteral(uri.getHost())) {
            throw new IllegalArgumentException("Webhook URL host is not allowed");
        }
        if (uri.getRawUserInfo() != null) {
            throw new IllegalArgumentException("Webhook URL user info is not allowed");
        }
        if (uri.getRawFragment() != null) {
            throw new IllegalArgumentException("Webhook URL fragment is not allowed");
        }
        int port = uri.getPort();
        if (port == -1 && hasExplicitPort(uri)) {

View on GitHub (pinned to 744c3d3075)

Solutions

1. Change the webhook URL to use https:// (or http:// for plain internal networks)
2. If a non-HTTP protocol was intended, use a component that supports it — this validator only accepts http/https
3. Keep the restriction: https is recommended to protect webhook payload confidentiality

Example fix

// before
validator.validateSyntax("ftp://example.com/hook");
// after
validator.validateSyntax("https://example.com/hook");

java.net.URI u = java.net.URI.create(url); String s = u.getScheme(); if (s == null || !(s.equalsIgnoreCase("http") || s.equalsIgnoreCase("https"))) reject(url);

boolean isHttpScheme(java.net.URI uri) { String s = uri.getScheme(); return "http".equalsIgnoreCase(s) || "https".equalsIgnoreCase(s); }

try { WebhookUrlValidator.validateSyntax(url); } catch (IllegalArgumentException e) { if (e.getMessage().contains("http or https")) { reject non-HTTPS scheme; } }

When it happens

Trigger: Passing URLs like 'ftp://example.com', 'file:///etc/passwd', 'gopher://...', or 'javascript:alert(1)' to validateSyntax/uri.

Common situations: SSRF/protocol hardening: someone configured a file:// or custom-scheme URL; misconfigured internal endpoints using unsupported schemes; malicious input attempting scheme-based attacks.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• Webhook URL host is not allowed
• Webhook URL is required
• Malformed webhook URL
• Webhook URL scheme is required
• Webhook URL host is required

AI-assisted analysis of pinpoint-apm/pinpoint@744c3d3075 (2026-09-07). Data as JSON: /api/errors/908ff132f72f054c. Report an issue: GitHub.