pinpoint-apm/pinpoint · error · IllegalArgumentException

Webhook URL user info is not allowed

Error message

Webhook URL user info is not allowed

What it means

WebhookUrlValidator.validateAuthority throws IllegalArgumentException when the URL contains user info (rawUserInfo != null), i.e. credentials embedded as scheme://user:pass@host. Embedding credentials in webhook URLs is disallowed for security (leaks secrets in logs/refs).

Source

Thrown at commons-server/src/main/java/com/navercorp/pinpoint/common/server/webhook/WebhookUrlValidator.java:126

        if (scheme == null) {
            throw new IllegalArgumentException("Webhook URL scheme is required");
        }

        String normalizedScheme = scheme.toLowerCase(Locale.ROOT);
        if (!"http".equals(normalizedScheme) && !"https".equals(normalizedScheme)) {
            throw new IllegalArgumentException("Webhook URL scheme must be http or https");
        }
    }

    private static void validateAuthority(URI uri) {
        if (uri.getHost() == null || uri.getHost().isBlank()) {
            throw new IllegalArgumentException("Webhook URL host is required");
        }
        if (isBlockedHostLiteral(uri.getHost())) {
            throw new IllegalArgumentException("Webhook URL host is not allowed");
        }
        if (uri.getRawUserInfo() != null) {
            throw new IllegalArgumentException("Webhook URL user info is not allowed");
        }
        if (uri.getRawFragment() != null) {
            throw new IllegalArgumentException("Webhook URL fragment is not allowed");
        }
        int port = uri.getPort();
        if (port == -1 && hasExplicitPort(uri)) {
            throw new IllegalArgumentException("Webhook URL port is not valid");
        }
        if (port == 0 || port > MAX_PORT) {
            throw new IllegalArgumentException("Webhook URL port is not allowed");
        }
    }

    private static boolean hasExplicitPort(URI uri) {
        String rawAuthority = uri.getRawAuthority();
        if (rawAuthority == null || rawAuthority.isEmpty()) {
            return false;
        }

View on GitHub (pinned to 744c3d3075)

Solutions

1. Remove the user:pass@ section from the URL; authenticate instead via headers/tokens configured separately on the receiver
2. If the receiver needs auth, use a URL query token or webhook signing secret supported by the platform
3. Be aware this also blocks '@'-based SSRF bypasses — supply the real host only

Example fix

// before
validator.validateSyntax("https://admin:secret@example.com/webhook");
// after
validator.validateSyntax("https://example.com/webhook"); // auth via header/token

if (url.contains("@") && url.contains("://")) reject(url); // or check URI.getRawUserInfo()

boolean hasNoUserInfo(java.net.URI uri) { return uri.getRawUserInfo() == null; }

try { WebhookUrlValidator.validateSyntax(url); } catch (IllegalArgumentException e) { if (e.getMessage().contains("user info")) { reject credentials-in-URL; } }

When it happens

Trigger: URLs like 'https://user:password@example.com/hook' or 'https://token@example.com/hook' passed to validateSyntax/uri.

Common situations: User pastes an authenticated URL from a browser or API tool (curl basic-auth style) into webhook config; attempt to smuggle credentials or inject '@' tricks (user-info SSRF bypass like https://expected.com@evil.com).

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• Webhook URL scheme must be http or https
• Webhook URL host is not allowed
• Webhook URL is required
• Malformed webhook URL
• Webhook URL scheme is required

AI-assisted analysis of pinpoint-apm/pinpoint@744c3d3075 (2026-09-07). Data as JSON: /api/errors/b0bf4af8f09ac3a4. Report an issue: GitHub.