vectordotdev/vector · error

Password must be valid UTF-8.

Error message

Password must be valid UTF-8.

What it means

The sibling of the username check: while attaching proxy authentication, Vector percent-decodes the password component of the proxy URL with urlencoding::decode(password).expect("Password must be valid UTF-8.") (lib/vector-core/src/config/proxy.rs). If the percent-escapes in the password decode to bytes that are not valid UTF-8, building the Proxy-Authorization header panics.

Source

Thrown at lib/vector-core/src/config/proxy.rs:169

    }

    fn build_proxy(
        &self,
        proxy_scheme: &'static str,
        proxy_url: Option<&String>,
    ) -> Result<Option<Proxy>, InvalidUri> {
        proxy_url
            .as_ref()
            .map(|url| {
                url.parse().map(|parsed| {
                    let mut proxy = Proxy::new(self.interceptor().intercept(proxy_scheme), parsed);
                    if let Ok(authority) = Url::parse(url)
                        && let Some(password) = authority.password()
                    {
                        let decoded_user = urlencoding::decode(authority.username())
                            .expect("username must be valid UTF-8.");
                        let decoded_pw =
                            urlencoding::decode(password).expect("Password must be valid UTF-8.");
                        let mut authorization =
                            Authorization::basic(&decoded_user, &decoded_pw).0.encode();
                        authorization.set_sensitive(true);
                        proxy.set_header(PROXY_AUTHORIZATION, authorization);
                    }
                    proxy
                })
            })
            .transpose()
    }

    fn http_proxy(&self) -> Result<Option<Proxy>, InvalidUri> {
        self.build_proxy("http", self.http.as_ref())
    }

    fn https_proxy(&self) -> Result<Option<Proxy>, InvalidUri> {
        self.build_proxy("https", self.https.as_ref())
    }

View on GitHub (pinned to 3708c39b12)

Solutions

1. Percent-encode the password's UTF-8 bytes correctly (e.g. ü -> %C3%BC), avoiding non-UTF-8 escapes like %80-%FF alone
2. Print the effective URL from the same environment Vector runs in (env | grep -i proxy) to spot mangling by shells, systemd, Docker, or Kubernetes
3. If the password genuinely contains non-UTF-8 bytes, rotate it to an ASCII/UTF-8 password — HTTP Basic auth cannot carry arbitrary bytes here

Example fix

# before
export http_proxy='http://user:p%80ssw0rd@proxy:3128'

# after
export http_proxy='http://user:p%C3%BCssw0rd@proxy:3128'  # password 'püssw0rd'

fn proxy_password_is_utf8(url: &str) -> bool {
    url::Url::parse(url)
        .ok()
        .and_then(|u| u.password().map(|p| percent_encoding::percent_decode_str(p).decode_utf8().is_ok()))
        .unwrap_or(true)
}

When it happens

Trigger: A proxy URL (from http_proxy/https_proxy env vars or the proxy config) that includes a userinfo password whose % sequences decode to invalid UTF-8, e.g. http://user:p%80w@proxy:3128. Triggered when Vector builds HTTP clients for sources/sinks with proxy support (during config load/topology build).

Common situations: Passwords generated by secrets managers that emit arbitrary bytes and are pasted into a URL without proper UTF-8 percent-encoding; shell quoting that mangles % or non-ASCII characters in env vars; copying proxy URLs between systems with different locale/encoding settings.

Related errors

• username must be valid UTF-8.
• not a valid path
• No ability to glob
• path and query should never fail to parse
• Serializer does not support JSON

AI-assisted analysis of vectordotdev/vector@3708c39b12 (2026-08-20). Data as JSON: /api/errors/a2c8fcaec31d1fa4. Report an issue: GitHub.