zeroclaw-labs/zeroclaw · error

URL userinfo is not allowed

Error message

URL userinfo is not allowed

What it means

Error "URL userinfo is not allowed" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-tools/src/web_fetch.rs:811

                .with_attrs(::serde_json::json!({"url": url, "error": format!("{e}")})),
            "web_fetch: invalid URL"
        );
        anyhow::Error::msg(format!("Invalid URL format: {e}"))
    })?;

    if !matches!(parsed.scheme(), "http" | "https") {
        ::zeroclaw_log::record!(
            WARN,
            ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Reject)
                .with_outcome(::zeroclaw_log::EventOutcome::Failure)
                .with_attrs(::serde_json::json!({"url": url})),
            "web_fetch: non-http(s) URL rejected"
        );
        anyhow::bail!("Only http:// and https:// URLs are allowed");
    }

    if !parsed.username().is_empty() || parsed.password().is_some() {
        anyhow::bail!("URL userinfo is not allowed");
    }

    let host = parsed
        .host_str()
        .ok_or_else(|| anyhow::Error::msg("URL must include a host"))?;
    // `Url::host_str()` serializes IPv6 literals with brackets, so parsing the
    // returned string directly would never recognize them.
    if host.starts_with('[') {
        anyhow::bail!("IPv6 hosts are not supported in web_fetch");
    }

    let host = host.trim_end_matches('.').to_ascii_lowercase();

    if host.is_empty() {
        anyhow::bail!("URL must include a valid host");
    }

    Ok(host)

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Remove the `user:password@` userinfo segment from the URL and pass credentials via headers or configuration instead.
2. Use a URL of the form https://host/path without embedded credentials.

When it happens

Trigger: Thrown at crates/zeroclaw-tools/src/web_fetch.rs:811 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/925c718496c5a617. Report an issue: GitHub.