symfony/http-foundation · error · BadRequestException

Invalid URI.

Error message

Invalid URI.

What it means

Request::create() runs parse_url() on the URI (with a '#' appended when no '?'/#' is present, to stabilize parsing). If parse_url returns false, the URI is fundamentally unparseable and Request::create() throws BadRequestException('Invalid URI.'). This follows the earlier, more specific scheme and userinfo checks.

Solutions

  1. Validate the URL with filter_var($uri, FILTER_VALIDATE_URL) before calling Request::create
  2. Fix the URI: add the missing scheme/host, url-encode spaces, close IPv6 brackets
  3. urlencode/rawurlencode dynamic path components before assembling the URI
  4. Catch BadRequestException around Request::create and reject the input with a 400

Example fix

// before
$request = Request::create('http://[::1:8080/path'); // parse_url fails -> throws
// after
$uri = 'http://[::1]:8080/path';
if (!filter_var($uri, \FILTER_VALIDATE_URL)) { throw new \InvalidArgumentException('Bad url'); }
$request = Request::create($uri);
Defensive patterns

Strategy: validation

Validate before calling

if (false === filter_var($uri, \FILTER_VALIDATE_URL) && !str_starts_with($uri, '/')) {
    throw new \InvalidArgumentException('Unparseable URL: '.$uri);
}

Type guard

function isParseableUri(string $uri): bool {
    return false !== parse_url($uri);
}

Try / catch

try {
    $request = Request::create($uri);
} catch (BadRequestException $e) {
    return new Response('Invalid URI', 400);
}

Prevention

When it happens

Trigger: Request::create('http://'), 'http:///path', a URI with an unparseable structure (e.g. malformed brackets 'http://[::1', bare control characters), or empty/garbage strings that fail parse_url.

Common situations: User-supplied URLs passed straight into Request::create (e.g. building sub-requests for redirects); URLs truncated by logs or config; IPv6 literals with missing closing bracket; URLs containing spaces that were never urlencoded.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/1b93ed4a239c7587. Report an issue: GitHub.

Appendix: source

Thrown at Request.php:397

            'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
            'HTTP_ACCEPT_LANGUAGE' => 'en-us,en;q=0.5',
            'HTTP_ACCEPT_CHARSET' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',
            'REMOTE_ADDR' => '127.0.0.1',
            'SCRIPT_NAME' => '',
            'SCRIPT_FILENAME' => '',
            'SERVER_PROTOCOL' => 'HTTP/1.1',
            'REQUEST_TIME' => time(),
            'REQUEST_TIME_FLOAT' => microtime(true),
        ], $server);

        $server['PATH_INFO'] = '';
        $server['REQUEST_METHOD'] = strtoupper($method);

        if (($i = strcspn($uri, ':/?#')) && ':' === ($uri[$i] ?? null) && (strspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-.') !== $i || strcspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'))) {
            throw new BadRequestException('Invalid URI: Scheme is malformed.');
        }
        if (false === $components = parse_url(\strlen($uri) !== strcspn($uri, '?#') ? $uri : $uri.'#')) {
            throw new BadRequestException('Invalid URI.');
        }

        $part = ($components['user'] ?? '').':'.($components['pass'] ?? '');

        if (':' !== $part && \strlen($part) !== strcspn($part, '[]')) {
            throw new BadRequestException('Invalid URI: Userinfo is malformed.');
        }
        if (($part = $components['host'] ?? '') && !self::isHostValid($part)) {
            throw new BadRequestException('Invalid URI: Host is malformed.');
        }
        if (false !== ($i = strpos($uri, '\\')) && $i < strcspn($uri, '?#')) {
            throw new BadRequestException('Invalid URI: A URI cannot contain a backslash.');
        }
        if (\strlen($uri) !== strcspn($uri, "\r\n\t")) {
            throw new BadRequestException('Invalid URI: A URI cannot contain CR/LF/TAB characters.');
        }
        if ('' !== $uri && (\ord($uri[0]) <= 32 || \ord($uri[-1]) <= 32)) {
            throw new BadRequestException('Invalid URI: A URI must not start nor end with ASCII control characters or spaces.');

View on GitHub (pinned to 5aea19cd67)