400 Bad Request: Request Path Contains an Invalid Character

Membrane API Gateway returns 400 Bad Request with the title Request path contains an invalid character. when it cannot parse the request URI. Membrane checks the URI before it routes the request and rejects URIs that contain characters not allowed by RFC 3986.

The Error Response

The response contains the status 400 Bad Request, the title Request path contains an invalid character., a detail that names the invalid character and its position in the URI, the problem type https://membrane-api.io/problems/user and a link to this page. The type user means that the request or the configuration caused the problem, not an internal failure of the gateway.

How Membrane Checks the Request URI

Before Membrane forwards a request, it parses the request URI to determine where to send it. Characters outside the allowed set must be percent-encoded by the client. Common examples:

Common Causes

Unencoded Characters in the Path or Query

The client sends characters such as spaces, {, }, |, ^, <, >, " or control characters without encoding them. For example, /products?name=red apple must be sent as /products?name=red%20apple.

Broken Percent-Encoding

A % must be followed by two hexadecimal digits. A request like /discounts/50% or /search?q=%zz is rejected. Encode a literal percent sign as %25.

An Invalid Absolute Request URI

Some clients and proxies send the full URL in the request line, for example GET http://example.com:8080/shop HTTP/1.1. If the scheme, user info, host or port of that URL is invalid, for example an empty host, a non-numeric port or an unclosed IPv6 bracket, the URI cannot be parsed.

An Invalid Host or Port in the Target URL

Less often, the cause is in the configuration. If the url of the API's target has a host or port that cannot be parsed, this is reported as an invalid request path, too. In that case, the detail names the host or port instead of a character in the path.

How to Fix It

1. Read the detail of the response. It names the invalid character and its position.
2. Percent-encode the character in the client. Most HTTP libraries do this when you pass path segments and query parameters separately instead of building the URL by hand.
3. If the detail names a host or port, check the target url of the API in your apis.yaml.

If you have to accept legacy clients that cannot be changed, you can relax the check. This weakens input validation, so use it only if you must:

configuration:
  uriFactory:
    allowIllegalCharacters: true
    autoEscapeBackslashes: true

configuration:
  uriFactory:
    allowIllegalCharacters: true
    autoEscapeBackslashes: true

autoEscapeBackslashes escapes backslashes in the URI instead of rejecting them.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.

Related Documentation

Configuration reference:

• target
• api

Tutorials with runnable examples:

• Path Parameter Routing

← All Membrane error messages