What causes "Failed to parse URI for field '%s'" in prestodb/presto?

Inspect the WWW-Authenticate / challenge response and fix the tokenUri/redirectUri value emitted by the authentication service to be a well-formed absolute URI (with scheme, e.g. https://...).

prestodb/presto · error · ClientException

Failed to parse URI for field '%s'

Error message

Failed to parse URI for field '%s'

What it means

ExternalAuthenticator.parseField extracts a URI-valued field from the challenge/realm attributes sent by the server (used for redirectUri and tokenUri). If the field value cannot be parsed as a URI, it throws this ClientException wrapping the URISyntaxException, aborting the external authentication handshake.

Source

Thrown at presto-client/src/main/java/com/facebook/presto/client/auth/external/ExternalAuthenticator.java:116

                Optional<URI> tokenUri = parseField(challenge.authParams(), TOKEN_URI_FIELD);
                Optional<URI> redirectUri = parseField(challenge.authParams(), REDIRECT_URI_FIELD);
                if (tokenUri.isPresent()) {
                    return Optional.of(new ExternalAuthentication(tokenUri.get(), redirectUri));
                }
            }
        }

        return Optional.empty();
    }

    private static Optional<URI> parseField(Map<String, String> fields, String key)
    {
        return Optional.ofNullable(fields.get(key)).map(value -> {
            try {
                return new URI(value);
            }
            catch (URISyntaxException e) {
                throw new ClientException(format("Failed to parse URI for field '%s'", key), e);
            }
        });
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

Inspect the WWW-Authenticate / challenge response and fix the tokenUri/redirectUri value emitted by the authentication service to be a well-formed absolute URI (with scheme, e.g. https://...).
Check the cause (getCause(), URISyntaxException) to see the exact offending character/index and correct the auth server configuration.
Bypass or upgrade any intermediary proxy that alters the authentication headers.
Upgrade/align the authentication service and Presto client versions so the expected field format matches.

Example fix

// before (auth service config)
tokenUri: auth.internal.example.com/token
// after
tokenUri: https://auth.internal.example.com/token

Defensive patterns

Strategy: try-catch

Validate before calling

String value = fields.get("tokenUri");
if (value == null || !URI.create(value.trim()).isAbsolute()) {
    throw new IllegalArgumentException("tokenUri field is not an absolute URI: " + value);
}

Type guard

boolean isAbsoluteUri(String s) {
    try { return s != null && new URI(s.trim()).isAbsolute(); }
    catch (URISyntaxException e) { return false; }
}

Try / catch

try {
    authenticate(session, fields);
} catch (ClientException e) {
    if (e.getCause() instanceof URISyntaxException) {
        throw new IllegalStateException("Bad auth challenge URI: " + e.getCause().getMessage(), e);
    }
    throw e;
}

Prevention

Ensure the authentication service emits absolute http(s) URIs in challenge fields.
Trim and normalize challenge values before URI parsing.
Inspect the URISyntaxException detail (index/character) when debugging auth config.
Keep auth service and Presto client versions aligned on the challenge format.

When it happens

Trigger: Server responds to an unauthenticated request with an external-authentication challenge whose attribute (e.g. tokenUri or redirectUri field) is missing its scheme, contains illegal characters, spaces, or is otherwise not a valid URI, so new URI(value) throws URISyntaxException.

Common situations: Misconfigured authentication service behind the coordinator emitting malformed realm attributes; a proxy that mangles or HTML-rewrites the WWW-Authenticate header; version mismatch where the auth server sends fields the client URI-parses strictly.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/3a788d0554284f9a. Report an issue: GitHub.