windmill-labs/windmill · error

Invalid authorization endpoint URL: {e}

Error message

Invalid authorization endpoint URL: {e}

What it means

build_basic_client parses the OAuth provider's authorization endpoint URL (config.auth_url) with Url::parse before constructing the oauth2 client. If the stored URL is not a syntactically valid absolute URL, the client cannot be built and an anyhow error wrapping the parse failure is returned.

Source

Thrown at backend/windmill-oauth/src/lib.rs:334

/// OAuth callback parameters
#[derive(Deserialize)]
pub struct OAuthCallback {
    pub code: String,
    pub state: String,
}

/// Build a basic OAuth client from configuration
pub fn build_basic_client(
    name: String,
    config: OAuthConfig,
    client_params: OAuthClient,
    login: bool,
    base_url: &str,
    override_callback: Option<String>,
) -> error::Result<(String, OClient)> {
    let auth_url = Url::parse(&config.auth_url)
        .map_err(|e| anyhow!("Invalid authorization endpoint URL: {e}"))?;
    let token_url =
        Url::parse(&config.token_url).map_err(|e| anyhow!("Invalid token endpoint URL: {e}"))?;

    let redirect_url = if login {
        format!("{base_url}/user/login_callback/{name}")
    } else if let Some(callback) = override_callback {
        callback
    } else {
        format!("{base_url}/oauth/callback/{name}")
    };

    let mut client = OClient::new(client_params.id, auth_url, token_url);
    if config.req_body_auth.unwrap_or(false) {
        client.set_auth_type(AuthType::RequestBody);
    }
    client.set_client_secret(client_params.secret.clone());
    client.set_redirect_url(
        Url::parse(&redirect_url).map_err(|e| anyhow!("Invalid redirect URL: {e}"))?,

View on GitHub (pinned to e474e8803c)

Solutions

  1. Fix the auth_url in the OAuth/SSO configuration so it is a full absolute URL including scheme, e.g. https://github.com/login/oauth/authorize
  2. Check for hidden whitespace, newlines, or placeholder text in the configured value
  3. If the value comes from an environment variable or DB column, verify it is actually populated (an empty string fails Url::parse)
  4. Validate with a quick test: Url::parse(value) in Rust or new URL(value) in JS to see the exact parse error embedded in the message

Example fix

// before
auth_url = "github.com/login/oauth/authorize"
// after
auth_url = "https://github.com/login/oauth/authorize"
Defensive patterns

Strategy: validation

Validate before calling

fn valid_auth_url(s: &str) -> bool { Url::parse(s).map(|u| u.scheme().starts_with("http")).unwrap_or(false) }
assert!(valid_auth_url("https://github.com/login/oauth/authorize"));

Type guard

fn is_absolute_http_url(s: &str) -> bool {
    Url::parse(s).map(|u| matches!(u.scheme(), "http" | "https") && !u.cannot_be_a_base()).unwrap_or(false)
}

Try / catch

match build_basic_client(&config, login, base_url, None) {
    Ok((name, client)) => client,
    Err(e) if e.to_string().contains("Invalid authorization endpoint URL") => {
        // fix config.auth_url before retrying
        return Err(e);
    }
    Err(e) => return Err(e),
}

Prevention

When it happens

Trigger: Calling build_basic_client (directly or via build_client_credentials_oauth_client) with an OAuthClient config whose auth_url is empty, missing a scheme (e.g. 'github.com/login/oauth/authorize'), contains spaces, or is otherwise not parseable as an absolute URL.

Common situations: Admins entering an SSO/OAuth provider config in instance settings paste only the host or path without 'https://'; a trailing typo or whitespace; a migration or environment variable that injects an empty AUTH_URL; provider documentation changes the endpoint shape.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/d17e6e709e6965f9. Report an issue: GitHub.