symfony/http-foundation · error · BadRequestException

Invalid URI: Path is malformed.

Error message

Invalid URI: Path is malformed.

What it means

Request::create() parses the given URI. When a URI has no scheme and no host, it is treated as a target path; if such a string contains a ':' before any '/' (e.g. 'localhost:8080/foo'), it is not a valid absolute path, so the library throws BadRequestException('Invalid URI: Path is malformed.') to reject it early.

Solutions

1. Prepend the missing scheme/host: Request::create('http://localhost:8080/path').
2. If a path-only request is intended, remove the host:port prefix and pass '/path' instead.
3. Build the URI with http_build_url() or implode of scheme+'://'+host to avoid manual string errors.
4. Validate the URI with filter_var($uri, FILTER_VALIDATE_URL) or parse_url before passing it to create().

Example fix

// before
$request = Request::create('localhost:8080/api/users');

// after
$request = Request::create('http://localhost:8080/api/users');

$uri = 'localhost:8080/api';
$parts = parse_url($uri);
if ($parts === false || (!isset($parts['scheme']) && ($uri[0] ?? '') !== '/' && str_contains(explode('/', $uri)[0], ':'))) {
    $uri = 'http://' . $uri;
}
$request = Request::create($uri);

try {
    $request = Request::create($uri);
} catch (BadRequestException $e) {
    $request = Request::create('http://' . ltrim($uri, '/'));
}

When it happens

Trigger: Calling Request::create() with a relative target that includes an authority-like prefix without a scheme, e.g. Request::create('localhost:8080/path') or Request::create('host:port'), where strpos($path, ':') matches before any '/'.

Common situations: Building test requests from host:port strings copied from a dev server; forgetting the 'http://' scheme; concatenating base URLs incorrectly in functional tests or kernel simulations; passing values from env vars like HOST:PORT directly as a URI.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Session has not been set.
• Invalid URI: Scheme is malformed.
• Invalid URI.
• Invalid URI: Userinfo is malformed.
• Invalid URI: Host is malformed.

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/a2f5c978e766ed0f. Report an issue: GitHub.

Appendix: source

Thrown at Request.php:454

        }

        if (isset($components['user'])) {
            $server['PHP_AUTH_USER'] = $components['user'];
        }

        if (isset($components['pass'])) {
            $server['PHP_AUTH_PW'] = $components['pass'];
        }

        if ('' === $path = $components['path'] ?? '') {
            $components['path'] = '/';
        } elseif (!isset($components['scheme']) && !isset($components['host']) && '/' !== $path[0]) {
            if (false !== $pos = strpos($path, '/')) {
                $path = substr($path, 0, $pos);
            }

            if (str_contains($path, ':')) {
                throw new BadRequestException('Invalid URI: Path is malformed.');
            }
        }

        switch (strtoupper($method)) {
            case 'POST':
            case 'PUT':
            case 'DELETE':
            case 'QUERY':
                if (!isset($server['CONTENT_TYPE'])) {
                    $server['CONTENT_TYPE'] = 'application/x-www-form-urlencoded';
                }
                // no break
            case 'PATCH':
                $request = $parameters;
                $query = [];
                break;
            default:
                $request = [];

View on GitHub (pinned to 5aea19cd67)