symfony/symfony · error · InvalidArgumentException

The URL "%s" is not valid.

Error message

The URL "%s" is not valid.

What it means

Thrown by Cookie::fromString() when the optional \$url argument cannot be parsed by parse_url() or has no 'host' component. The URL is used to derive the cookie's domain and path, so a host-less or malformed URL is rejected.

Source

Thrown at src/Symfony/Component/BrowserKit/Cookie.php:150

        }

        [$name, $value] = explode('=', array_shift($parts), 2);

        $values = [
            'name' => trim($name),
            'value' => trim($value),
            'expires' => null,
            'path' => '/',
            'domain' => '',
            'secure' => false,
            'httponly' => false,
            'passedRawValue' => true,
            'samesite' => null,
        ];

        if (null !== $url) {
            if (false === ($urlParts = parse_url($url)) || !isset($urlParts['host'])) {
                throw new InvalidArgumentException(\sprintf('The URL "%s" is not valid.', $url));
            }

            $values['domain'] = $urlParts['host'];
            $values['path'] = isset($urlParts['path']) ? substr($urlParts['path'], 0, strrpos($urlParts['path'], '/')) : '';
        }

        foreach ($parts as $part) {
            $part = trim($part);

            if ('secure' === strtolower($part)) {
                // Ignore the secure flag if the original URI is not given or is not HTTPS
                if (null === $url || !isset($urlParts['scheme']) || 'https' !== $urlParts['scheme']) {
                    continue;
                }

                $values['secure'] = true;

                continue;

View on GitHub (pinned to 698e28026c)

Solutions

1. Pass an absolute URL with a scheme and host (e.g. 'https://example.com/path').
2. Omit the \$url argument entirely if you don't need domain/path derivation.
3. Resolve relative URLs to absolute before calling, e.g. via a URL resolver.

Example fix

// before
$cookie = Cookie::fromString('sid=1', '/admin');

// after
$cookie = Cookie::fromString('sid=1', 'https://example.com/admin');

// Pass an absolute URL with scheme + host, or omit \$url.
$parts = parse_url($url);
if ($parts && isset($parts['host'])) {
    $cookie = Cookie::fromString($header, $url);
} else {
    $cookie = Cookie::fromString($header); // no URL context
}

function isAbsoluteUrl(string $url): bool
{
    $p = parse_url($url);
    return $p !== false && isset($p['host'], $p['scheme']);
}

try {
    $cookie = Cookie::fromString($header, $url);
} catch (\Symfony\Component\BrowserKit\Exception\InvalidArgumentException $e) {
    // URL invalid; retry without URL context
}

When it happens

Trigger: Calling Cookie::fromString('sid=1', '//relative/path') or Cookie::fromString('sid=1', 'not a url') — anything where parse_url() returns false or omits host (Cookie.php:149).

Common situations: Passing a relative URL, a bare path, or a mistyped scheme to fromString(). Common when the cookie is parsed from a request whose full absolute URL wasn't captured.

Related errors

• The cookie expiration time "%s" is not valid.
• The cookie string "%s" is not valid.
• JSON content was expected to decode to an array, "%s" return
• The options tags, tag, parameters & parameter cannot be comb
• The options tags, tag, parameters & parameter cannot be comb

AI-assisted analysis of symfony/symfony@698e28026c (2026-08-06). Data as JSON: /api/errors/b0815b776b4c6fce. Report an issue: GitHub.