Misleading URL Error

[BrettskiPy]

Hello everyone. I recently loaded an environment variable URL incorrectly and there happened to be an extra space in front of the url which ultimately ended up looking something like this:

some_env_var_url= " http://someurl.org/get" 
httpx.get(some_env_var_url)

The error I received was unfortunately not helpful to myself or my team and took us way too much time to debug:

httpx.UnsupportedProtocol: Request URL is missing an 'http://' or 'https://' protocol.

Perhaps a more specific error may help with these kinds of silly mistakes or including the actual URL in this error? I would be hesitant to suggest automatically stripping the extra space. Thanks.

[zanieb]

Would it be sufficient to display the URL? Request URL " http://someurl.org/get" is missing...

[tomchristie]

Good suggestion.
Would someone like to write up an issue for this, and we can then resolve it?

[zanieb]

Before I do:

1. Is there any security concern with printing the URL?
2. Is it common that the URL is really long i.e. with parameters here?

[BrettskiPy]

1. I'm not sure
2. Perhaps shifting the wording to something like this may help with the longer URLs httpx.UnsupportedProtocol: Missing 'http://' or 'https://' protocol in the request URL " http://someurl.org/get"

[Cleptomania]

Printing out the URL is probably not good from a security standpoint. It's pretty common to have credentials/secrets in URL via parameters, or for something like HTTP Basic auth, so printing the full URL would create the potential to expose those into logging systems.

In this very specific case, perhaps printing out the raw protocol, for example httpx.UnsupportedProtocol: Missing 'http://' or 'https://' protocol in the request. Actual input " http://"(this probably needs better wording)

Another option I can think of would be to use strip() on the URL, but I'm not sure if that causes problems with any other valid use cases, and that introduces an actual functionality change as opposed to just better error messaging.

[akarpodinis]

I'm interested in strip() because requests does this (specifically lstrip()), and the URI RFC indicates that spaces are unsafe and need to be encoded. To me this doesn't quite feel like a stretch. You're right that it's changing behavior, but I'd suggest that the behavior would be changing to be more consistent with having requests-compatible behavior, and closer to the RFC specification.