prestodb/presto · error · IllegalArgumentException

Invalid token URI:

Error message

Invalid token URI: 

What it means

HttpTokenPoller.prepareRequestBuilder converts the tokenUri from the authentication challenge into an OkHttp HttpUrl via HttpUrl.get(tokenUri), which returns null when the URI cannot be represented as a valid HTTP(S) URL (e.g. missing scheme or non-http scheme). It then throws this IllegalArgumentException naming the offending URI.

Source

Thrown at presto-client/src/main/java/com/facebook/presto/client/auth/external/HttpTokenPoller.java:124

                        try (Response response = client.get().newCall(request)
                                .execute()) {
                            return response.code();
                        }
                    });
        }
        catch (FailsafeException e) {
            if (e.getCause() instanceof IOException) {
                throw new UncheckedIOException((IOException) e.getCause());
            }
            throw e;
        }
    }

    private static Request.Builder prepareRequestBuilder(URI tokenUri)
    {
        HttpUrl url = HttpUrl.get(tokenUri);
        if (url == null) {
            throw new IllegalArgumentException("Invalid token URI: " + tokenUri);
        }

        return new Request.Builder()
                .url(url)
                .addHeader(USER_AGENT, USER_AGENT_VALUE);
    }

    private TokenPollResult executePoll(Request request)
            throws IOException
    {
        JsonResponse<TokenPollRepresentation> response = executeRequest(request);

        if ((response.getStatusCode() == HTTP_OK) && response.hasValue()) {
            return response.getValue().toResult();
        }

        Optional<String> responseBody = Optional.ofNullable(response.getResponseBody());
        String message = format("Request to %s failed: %s [Error: %s]", request.url(), response, responseBody.orElse("<Response Too Large>"));

View on GitHub (pinned to 55bb57d202)

Solutions

1. Correct the tokenUri emitted by the authentication service to be an absolute http:// or https:// URL.
2. Verify the URI parses as an HTTP URL before invoking the authenticator (HttpUrl.get(...) != null or starts with http).
3. Check for hidden whitespace/encoding issues in the challenge field or config and trim/normalize the URI.
4. If you control the client, validate with HttpUrl.parse and fail early with a clearer message.

Example fix

// before
tokenUri = "auth.example.com/token";          // no scheme -> HttpUrl.get returns null
// after
tokenUri = "https://auth.example.com/token";  // valid HTTP URL

okhttp3.HttpUrl parsed = okhttp3.HttpUrl.parse(tokenUri);
if (parsed == null || !(parsed.isHttps() || parsed.isHttp())) {
    throw new IllegalArgumentException("tokenUri must be an absolute http(s) URL: " + tokenUri);
}

boolean isValidHttpUrl(URI tokenUri) {
    String s = tokenUri.toString().trim();
    return okhttp3.HttpUrl.parse(s) != null;
}

try {
    poller.pollForToken(httpClient, fields, timeout);
} catch (IllegalArgumentException e) {
    throw new IllegalStateException("Authentication service returned invalid tokenUri: " + e.getMessage(), e);
}

When it happens

Trigger: pollForToken/request path receives a tokenUri from the external-auth challenge whose scheme is not http/https (e.g. a relative or 'localhost:...' schemeless URI) so HttpUrl.get returns null, triggering the exception before any request is built.

Common situations: Authentication service emitting a token URI without the http(s):// scheme; trailing whitespace or invalid characters in the configured URI; mixing ws:// or custom schemes that OkHttp's HttpUrl rejects for a token poll.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• UNEXPECTED_ACCUMULO_ERROR
• UNEXPECTED_ACCUMULO_ERROR
• Failed to create Credentials from key
• Invalid value [%s]. Valid values: %s
• CLICKHOUSE_QUERY_GENERATOR_FAILURE

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/143d7b84e7055c31. Report an issue: GitHub.