From 2c04413fa366cdc061e73e8b96d871a737e80327 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 09:30:07 -0700
Subject: [PATCH 01/23] remove Fleet URL validation on settings page

---
 .../cards/WebAddress/WebAddress.tsx           | 23 +------------------
 1 file changed, 1 insertion(+), 22 deletions(-)

diff --git a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
index f18a9b594826..deab84282fd4 100644
--- a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
+++ b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
@@ -3,7 +3,6 @@ import React, { useState } from "react";
 import Button from "components/buttons/Button";
 // @ts-ignore
 import InputField from "components/forms/fields/InputField";
-import validUrl from "components/forms/validators/valid_url";
 import SectionHeader from "components/SectionHeader";
 import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
 
@@ -13,10 +12,6 @@ interface IWebAddressFormData {
   serverURL: string;
 }
 
-interface IWebAddressFormErrors {
-  server_url?: string | null;
-}
-
 const baseClass = "app-config-form";
 
 const WebAddress = ({
@@ -32,22 +27,8 @@ const WebAddress = ({
 
   const { serverURL } = formData;
 
-  const [formErrors, setFormErrors] = useState<IWebAddressFormErrors>({});
-
   const onInputChange = ({ name, value }: IFormField) => {
     setFormData({ ...formData, [name]: value });
-    setFormErrors({});
-  };
-
-  const validateForm = () => {
-    const errors: IWebAddressFormErrors = {};
-    if (!serverURL) {
-      errors.server_url = "Fleet server URL must be present";
-    } else if (!validUrl({ url: serverURL, protocols: ["http", "https"] })) {
-      errors.server_url = `${serverURL} is not a valid URL`;
-    }
-
-    setFormErrors(errors);
   };
 
   const onFormSubmit = (evt: React.MouseEvent<HTMLFormElement>) => {
@@ -79,8 +60,6 @@ const WebAddress = ({
             name="serverURL"
             value={serverURL}
             parseTarget
-            onBlur={validateForm}
-            error={formErrors.server_url}
             tooltip="The base URL of this instance for use in Fleet links."
             disabled={gitOpsModeEnabled}
           />
@@ -90,7 +69,7 @@ const WebAddress = ({
               <Button
                 type="submit"
                 variant="brand"
-                disabled={Object.keys(formErrors).length > 0 || disableChildren}
+                disabled={disableChildren}
                 className="button-wrap"
                 isLoading={isUpdatingSettings}
               >

From 880ab3ea6ebb2a1f4174dc752c1bc6b0c0db8808 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 09:30:33 -0700
Subject: [PATCH 02/23] remove `https` validation from the server

---
 server/service/validation_setup.go | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index cb757d7b9891..d8305b130943 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -2,9 +2,6 @@ package service
 
 import (
 	"context"
-	"errors"
-	"net/url"
-	"strings"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -28,14 +25,14 @@ func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.A
 }
 
 func validateServerURL(urlString string) error {
-	serverURL, err := url.Parse(urlString)
-	if err != nil {
-		return err
-	}
+	// serverURL, err := url.Parse(urlString)
+	// if err != nil {
+	// 	return err
+	// }
 
-	if serverURL.Scheme != "https" && !strings.Contains(serverURL.Host, "localhost") {
-		return errors.New("url scheme must be https")
-	}
+	// if serverURL.Scheme != "https" && !strings.Contains(serverURL.Host, "localhost") {
+	// 	return errors.New("url scheme must be https")
+	// }
 
 	return nil
 }

From 5d91eb3389744d0cec364a12bf9745d73a69606c Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 09:33:45 -0700
Subject: [PATCH 03/23] remove https URL validation from setup flow

---
 .../components/forms/RegistrationForm/FleetDetails/helpers.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js b/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
index f66547dfa737..ee6a0c613f12 100644
--- a/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
+++ b/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
@@ -8,10 +8,6 @@ const validate = (formData) => {
     errors.server_url = "Fleet web address must be completed";
   }
 
-  if (fleetWebAddress && !startsWith(fleetWebAddress, "https://")) {
-    errors.server_url = "Fleet web address must start with https://";
-  }
-
   const valid = !size(errors);
 
   return { valid, errors };

From 9044315a4c6918103533f31e6366101f112f9d4a Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 09:37:22 -0700
Subject: [PATCH 04/23] change file

---
 changes/27454-validation | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changes/27454-validation

diff --git a/changes/27454-validation b/changes/27454-validation
new file mode 100644
index 000000000000..41d6629fa8a8
--- /dev/null
+++ b/changes/27454-validation
@@ -0,0 +1 @@
+- Accept any string for the Fleet web URL

From 883400c47ee31d6dbf25487b47ec502298717ce3 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 09:43:17 -0700
Subject: [PATCH 05/23] update frontend patterns doc to prevent all form
 submission when a form is invalid

---
 frontend/docs/patterns.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frontend/docs/patterns.md b/frontend/docs/patterns.md
index f417de7482c8..bbd9c285f2a1 100644
--- a/frontend/docs/patterns.md
+++ b/frontend/docs/patterns.md
@@ -211,6 +211,7 @@ When building a React-controlled form:
 React.FormEvent<HTMLFormElement>` argument and, critically, calls `evt.preventDefault()` in its
 body. This prevents the HTML `form`'s default submit behavior from interfering with our custom
 handler's logic.
+- This handler should do nothing if the form is in an invalid state, preventing submission by all means.
 - Assign that handler to the `form`'s `onSubmit` property (*not* the submit button's `onClick`)
 
 ### Data validation

From 00efbad1365da44121780dd6ece9598516a7b400 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 09:49:23 -0700
Subject: [PATCH 06/23] update FE test

---
 .../FleetDetails/FleetDetails.tests.jsx         | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/frontend/components/forms/RegistrationForm/FleetDetails/FleetDetails.tests.jsx b/frontend/components/forms/RegistrationForm/FleetDetails/FleetDetails.tests.jsx
index 7ca5b9249dad..b06007841bbd 100644
--- a/frontend/components/forms/RegistrationForm/FleetDetails/FleetDetails.tests.jsx
+++ b/frontend/components/forms/RegistrationForm/FleetDetails/FleetDetails.tests.jsx
@@ -29,23 +29,6 @@ describe("FleetDetails - form", () => {
     ).toBeInTheDocument();
   });
 
-  it("validates the fleet web address field starts with https://", async () => {
-    const { user } = renderWithSetup(
-      <FleetDetails handleSubmit={handleSubmitSpy} currentPage />
-    );
-
-    await user.type(
-      screen.getByRole("textbox", { name: "Fleet web address" }),
-      "http://gnar.Fleet.co"
-    );
-    await user.click(screen.getByRole("button", { name: "Next" }));
-
-    expect(handleSubmitSpy).not.toHaveBeenCalled();
-    expect(
-      screen.getByText("Fleet web address must start with https://")
-    ).toBeInTheDocument();
-  });
-
   it("submits the form when valid", async () => {
     const { user } = renderWithSetup(
       <FleetDetails handleSubmit={handleSubmitSpy} currentPage />

From 66567e1c3a8cc922bede4c05f6caa442b3f37cc9 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 10:31:21 -0700
Subject: [PATCH 07/23] clean up server check

---
 server/service/validation_setup.go | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index d8305b130943..6a7d383a68ca 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -9,30 +9,11 @@ import (
 
 func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.AppConfig) (*fleet.AppConfig, error) {
 	invalid := &fleet.InvalidArgumentError{}
-	var serverURLString string
 	if payload.ServerSettings.ServerURL == "" {
 		invalid.Append("server_url", "missing required argument")
-	} else {
-		serverURLString = cleanupURL(payload.ServerSettings.ServerURL)
-	}
-	if err := validateServerURL(serverURLString); err != nil {
-		invalid.Append("server_url", err.Error())
 	}
 	if invalid.HasErrors() {
 		return nil, ctxerr.Wrap(ctx, invalid)
 	}
 	return mw.Service.NewAppConfig(ctx, payload)
 }
-
-func validateServerURL(urlString string) error {
-	// serverURL, err := url.Parse(urlString)
-	// if err != nil {
-	// 	return err
-	// }
-
-	// if serverURL.Scheme != "https" && !strings.Contains(serverURL.Host, "localhost") {
-	// 	return errors.New("url scheme must be https")
-	// }
-
-	return nil
-}

From 133ba400c0382a44c6d2b6165ef1e0a2a7acb4a5 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 10:38:25 -0700
Subject: [PATCH 08/23] add comments

---
 .../components/forms/RegistrationForm/FleetDetails/helpers.js | 4 +++-
 server/service/validation_setup.go                            | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js b/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
index ee6a0c613f12..706c22a9fd1a 100644
--- a/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
+++ b/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
@@ -1,4 +1,4 @@
-import { size, startsWith } from "lodash";
+import { size } from "lodash";
 
 const validate = (formData) => {
   const errors = {};
@@ -8,6 +8,8 @@ const validate = (formData) => {
     errors.server_url = "Fleet web address must be completed";
   }
 
+  // explicitly removed check for "https" scheme
+
   const valid = !size(errors);
 
   return { valid, errors };
diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index 6a7d383a68ca..daa3d546e481 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -12,6 +12,7 @@ func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.A
 	if payload.ServerSettings.ServerURL == "" {
 		invalid.Append("server_url", "missing required argument")
 	}
+	// explicitly removed check for "https" scheme
 	if invalid.HasErrors() {
 		return nil, ctxerr.Wrap(ctx, invalid)
 	}

From 2d12dc4a0686febb2b3dad9c772708626084ccd5 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 12:26:13 -0700
Subject: [PATCH 09/23] update all 3 validation locations to use the same
 conditions of satisfaction

---
 .../RegistrationForm/FleetDetails/helpers.js  | 13 ++++++++--
 .../forms/validators/valid_url/valid_url.ts   | 12 +++++++--
 .../cards/WebAddress/WebAddress.tsx           | 26 ++++++++++++++++++-
 server/service/validation_setup.go            | 23 +++++++++++++++-
 4 files changed, 68 insertions(+), 6 deletions(-)

diff --git a/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js b/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
index 706c22a9fd1a..092d4e83f20f 100644
--- a/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
+++ b/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
@@ -1,15 +1,24 @@
 import { size } from "lodash";
 
+import validUrl from "components/forms/validators/valid_url";
+
 const validate = (formData) => {
   const errors = {};
   const { server_url: fleetWebAddress } = formData;
 
   if (!fleetWebAddress) {
     errors.server_url = "Fleet web address must be completed";
+  } else if (
+    !validUrl({
+      url: fleetWebAddress,
+      protocols: ["http", "https"],
+      allowAnyLocalHost: true,
+    })
+  ) {
+    errors.server_url =
+      "Fleet web address must be a valid https, http, or localhost URL";
   }
 
-  // explicitly removed check for "https" scheme
-
   const valid = !size(errors);
 
   return { valid, errors };
diff --git a/frontend/components/forms/validators/valid_url/valid_url.ts b/frontend/components/forms/validators/valid_url/valid_url.ts
index 1707e991f1c8..5ec9088da10c 100644
--- a/frontend/components/forms/validators/valid_url/valid_url.ts
+++ b/frontend/components/forms/validators/valid_url/valid_url.ts
@@ -6,8 +6,16 @@ interface IValidUrl {
   url: string;
   /**  Validate protocols specified */
   protocols?: ("http" | "https")[];
+  allowAnyLocalHost?: boolean;
 }
 
-export default ({ url, protocols }: IValidUrl): boolean => {
-  return isURL(url, { protocols });
+export default ({
+  url,
+  protocols,
+  allowAnyLocalHost = false,
+}: IValidUrl): boolean => {
+  if (allowAnyLocalHost && url.includes("localhost")) return true;
+  // this function also has a `require_valid_protocol` option, though as called it seems to already validate
+  // that the URL's protocol is one of those specified
+  return isURL(url, { protocols, require_protocol: !!protocols?.length });
 };
diff --git a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
index deab84282fd4..0411a1237be0 100644
--- a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
+++ b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
@@ -3,6 +3,7 @@ import React, { useState } from "react";
 import Button from "components/buttons/Button";
 // @ts-ignore
 import InputField from "components/forms/fields/InputField";
+import validUrl from "components/forms/validators/valid_url";
 import SectionHeader from "components/SectionHeader";
 import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
 
@@ -12,6 +13,9 @@ interface IWebAddressFormData {
   serverURL: string;
 }
 
+interface IWebAddressFormErrors {
+  server_url?: string | null;
+}
 const baseClass = "app-config-form";
 
 const WebAddress = ({
@@ -27,10 +31,28 @@ const WebAddress = ({
 
   const { serverURL } = formData;
 
+  const [formErrors, setFormErrors] = useState<IWebAddressFormErrors>({});
   const onInputChange = ({ name, value }: IFormField) => {
     setFormData({ ...formData, [name]: value });
+    setFormErrors({});
   };
 
+  const validateForm = () => {
+    const errors: IWebAddressFormErrors = {};
+    if (!serverURL) {
+      errors.server_url = "Fleet server URL must be present";
+    } else if (
+      !validUrl({
+        url: serverURL,
+        protocols: ["http", "https"],
+        allowAnyLocalHost: true,
+      })
+    ) {
+      errors.server_url = `${serverURL} is not a valid URL`;
+    }
+
+    setFormErrors(errors);
+  };
   const onFormSubmit = (evt: React.MouseEvent<HTMLFormElement>) => {
     evt.preventDefault();
 
@@ -60,6 +82,8 @@ const WebAddress = ({
             name="serverURL"
             value={serverURL}
             parseTarget
+            onBlur={validateForm}
+            error={formErrors.server_url}
             tooltip="The base URL of this instance for use in Fleet links."
             disabled={gitOpsModeEnabled}
           />
@@ -69,7 +93,7 @@ const WebAddress = ({
               <Button
                 type="submit"
                 variant="brand"
-                disabled={disableChildren}
+                disabled={Object.keys(formErrors).length > 0 || disableChildren}
                 className="button-wrap"
                 isLoading={isUpdatingSettings}
               >
diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index daa3d546e481..39702be233f0 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -2,6 +2,9 @@ package service
 
 import (
 	"context"
+	"errors"
+	"net/url"
+	"strings"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -9,12 +12,30 @@ import (
 
 func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.AppConfig) (*fleet.AppConfig, error) {
 	invalid := &fleet.InvalidArgumentError{}
+	var serverURLString string
 	if payload.ServerSettings.ServerURL == "" {
 		invalid.Append("server_url", "missing required argument")
+	} else {
+		serverURLString = cleanupURL(payload.ServerSettings.ServerURL)
+	}
+	if err := validateServerURL(serverURLString); err != nil {
+		invalid.Append("server_url", err.Error())
 	}
-	// explicitly removed check for "https" scheme
 	if invalid.HasErrors() {
 		return nil, ctxerr.Wrap(ctx, invalid)
 	}
 	return mw.Service.NewAppConfig(ctx, payload)
 }
+
+func validateServerURL(urlString string) error {
+	serverURL, err := url.Parse(urlString)
+	if err != nil {
+		return err
+	}
+
+	if !(serverURL.Scheme == "https" || serverURL.Scheme == "http") && !strings.Contains(serverURL.Host, "localhost") {
+		return errors.New("url must use https, http, or localhost")
+	}
+
+	return nil
+}

From 48b09b3fa79854650c43cb36234df97764af9053 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 13:01:49 -0700
Subject: [PATCH 10/23] disable submit by all means when invalid

---
 .../admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx  | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
index 0411a1237be0..34fa0ba77140 100644
--- a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
+++ b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
@@ -1,4 +1,5 @@
 import React, { useState } from "react";
+import { size } from "lodash";
 
 import Button from "components/buttons/Button";
 // @ts-ignore
@@ -53,8 +54,12 @@ const WebAddress = ({
 
     setFormErrors(errors);
   };
+
+  const formInvalid = !!size(formErrors);
+
   const onFormSubmit = (evt: React.MouseEvent<HTMLFormElement>) => {
     evt.preventDefault();
+    if (formInvalid) return;
 
     // Formatting of API not UI
     const formDataToSubmit = {
@@ -93,7 +98,7 @@ const WebAddress = ({
               <Button
                 type="submit"
                 variant="brand"
-                disabled={Object.keys(formErrors).length > 0 || disableChildren}
+                disabled={formInvalid || disableChildren}
                 className="button-wrap"
                 isLoading={isUpdatingSettings}
               >

From bc033b5c563853ef5ee64cd965e752ace9c5beae Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 13:02:22 -0700
Subject: [PATCH 11/23] improve server validation

---
 server/fleet/errors.go             |  3 +++
 server/service/appconfig.go        | 14 ++++++++++----
 server/service/validation_setup.go | 16 +++++++++++-----
 3 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/server/fleet/errors.go b/server/fleet/errors.go
index f04ceba4aa5a..958193c4b180 100644
--- a/server/fleet/errors.go
+++ b/server/fleet/errors.go
@@ -627,6 +627,9 @@ const (
 
 	// Labels
 	InvalidLabelSpecifiedErrMsg = "Invalid label name(s):"
+
+	// Config
+	InvalidServerURLMsg = "Server URL must use https or http scheme with valid host, or localhost."
 )
 
 // ConflictError is used to indicate a conflict, such as a UUID conflict in the DB.
diff --git a/server/service/appconfig.go b/server/service/appconfig.go
index 23f2f9078102..71b83484ff6d 100644
--- a/server/service/appconfig.go
+++ b/server/service/appconfig.go
@@ -417,6 +417,10 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 	}
 	if appConfig.ServerSettings.ServerURL == "" {
 		invalid.Append("server_url", "Fleet server URL must be present")
+	} else {
+		if err := ValidateServerURL(appConfig.ServerSettings.ServerURL); err != nil {
+			invalid.Append("server_url", err.Error())
+		}
 	}
 
 	if appConfig.ActivityExpirySettings.ActivityExpiryEnabled && appConfig.ActivityExpirySettings.ActivityExpiryWindow < 1 {
@@ -924,8 +928,8 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 }
 
 func (svc *Service) processAppConfigCAs(ctx context.Context, newAppConfig *fleet.AppConfig, oldAppConfig *fleet.AppConfig,
-	appConfig *fleet.AppConfig, invalid *fleet.InvalidArgumentError) (appConfigCAStatus, error) {
-
+	appConfig *fleet.AppConfig, invalid *fleet.InvalidArgumentError,
+) (appConfigCAStatus, error) {
 	var invalidLicense bool
 	fleetLicense, _ := license.FromContext(ctx)
 	if newAppConfig.Integrations.NDESSCEPProxy.Set && newAppConfig.Integrations.NDESSCEPProxy.Valid && !fleetLicense.IsPremium() {
@@ -1249,7 +1253,8 @@ func (svc *Service) populateCustomSCEPChallenges(ctx context.Context, remainingO
 // filterDeletedDigiCertCAs identifies deleted DigiCert integrations in the provided configs.
 // It mutates the provided result to set a deleted status where applicable and returns a list of the remaining (non-deleted) integrations.
 func filterDeletedDigiCertCAs(oldAppConfig *fleet.AppConfig, newAppConfig *fleet.AppConfig,
-	result *appConfigCAStatus) []fleet.DigiCertIntegration {
+	result *appConfigCAStatus,
+) []fleet.DigiCertIntegration {
 	remainingOldCAs := make([]fleet.DigiCertIntegration, 0, len(oldAppConfig.Integrations.DigiCert.Value))
 	for _, oldCA := range oldAppConfig.Integrations.DigiCert.Value {
 		var found bool
@@ -1271,7 +1276,8 @@ func filterDeletedDigiCertCAs(oldAppConfig *fleet.AppConfig, newAppConfig *fleet
 // filterDeletedCustomSCEPCAs identifies deleted custom SCEP integrations in the provided configs.
 // It mutates the provided result to set a deleted status where applicable and returns a list of the remaining (non-deleted) integrations.
 func filterDeletedCustomSCEPCAs(oldAppConfig *fleet.AppConfig, newAppConfig *fleet.AppConfig,
-	result *appConfigCAStatus) []fleet.CustomSCEPProxyIntegration {
+	result *appConfigCAStatus,
+) []fleet.CustomSCEPProxyIntegration {
 	remainingOldCAs := make([]fleet.CustomSCEPProxyIntegration, 0, len(oldAppConfig.Integrations.CustomSCEPProxy.Value))
 	for _, oldCA := range oldAppConfig.Integrations.CustomSCEPProxy.Value {
 		var found bool
diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index 39702be233f0..d3d6a82925ea 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -18,7 +18,7 @@ func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.A
 	} else {
 		serverURLString = cleanupURL(payload.ServerSettings.ServerURL)
 	}
-	if err := validateServerURL(serverURLString); err != nil {
+	if err := ValidateServerURL(serverURLString); err != nil {
 		invalid.Append("server_url", err.Error())
 	}
 	if invalid.HasErrors() {
@@ -27,15 +27,21 @@ func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.A
 	return mw.Service.NewAppConfig(ctx, payload)
 }
 
-func validateServerURL(urlString string) error {
+func ValidateServerURL(urlString string) error {
 	serverURL, err := url.Parse(urlString)
 	if err != nil {
 		return err
 	}
 
-	if !(serverURL.Scheme == "https" || serverURL.Scheme == "http") && !strings.Contains(serverURL.Host, "localhost") {
-		return errors.New("url must use https, http, or localhost")
+	if serverURL.Scheme == "https" || serverURL.Scheme == "http" {
+		if serverURL.Host == "" {
+			return errors.New(fleet.InvalidServerURLMsg)
+		}
+	} else {
+		// invalid scheme, permit only localhost URLs
+		if !strings.Contains(serverURL.Host, "localhost") {
+			return errors.New(fleet.InvalidServerURLMsg)
+		}
 	}
-
 	return nil
 }

From c70141f042f86bf28662aefff98e44b4137c4184 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 13:20:09 -0700
Subject: [PATCH 12/23] Update org settings `WebAddress` form validation to
 Fleet-standard

---
 frontend/docs/patterns.md                     |  9 +--
 .../cards/WebAddress/WebAddress.tsx           | 66 ++++++++++++-------
 2 files changed, 48 insertions(+), 27 deletions(-)

diff --git a/frontend/docs/patterns.md b/frontend/docs/patterns.md
index bbd9c285f2a1..f17bad4f5ea3 100644
--- a/frontend/docs/patterns.md
+++ b/frontend/docs/patterns.md
@@ -208,10 +208,10 @@ When building a React-controlled form:
 - Use the native HTML `form` element to wrap the form.
 - Use a `Button` component with `type="submit"` for its submit button.
 - Write a submit handler, e.g. `handleSubmit`, that accepts an `evt:
-React.FormEvent<HTMLFormElement>` argument and, critically, calls `evt.preventDefault()` in its
-body. This prevents the HTML `form`'s default submit behavior from interfering with our custom
+React.FormEvent<HTMLFormElement>` argument and, critically:
+  - calls `evt.preventDefault()` in its body. This prevents the HTML `form`'s default submit behavior from interfering with our custom
 handler's logic.
-- This handler should do nothing if the form is in an invalid state, preventing submission by all means.
+  - does nothing (e.g., returns `null`) if the form is in an invalid state, preventing submission by any means.
 - Assign that handler to the `form`'s `onSubmit` property (*not* the submit button's `onClick`)
 
 ### Data validation
@@ -249,7 +249,9 @@ const onInputChange = ({ name, value }: IFormField) => {
   // new errors are only set onBlur
   const errsToSet: Record<string, string> = {};
   Object.keys(formErrors).forEach((k) => {
+    // @ts-ignore
     if (newErrs[k]) {
+      // @ts-ignore
       errsToSet[k] = newErrs[k];
     }
   });
@@ -271,7 +273,6 @@ const onInputBlur = () => {
 ```tsx
 const onFormSubmit = (evt: React.MouseEvent<HTMLFormElement>) => {
   evt.preventDefault();
-
   // return null if there are errors
   const errs = validateFormData(formData);
   if (Object.keys(errs).length > 0) {
diff --git a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
index 34fa0ba77140..e3b8139d11bd 100644
--- a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
+++ b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
@@ -19,6 +19,23 @@ interface IWebAddressFormErrors {
 }
 const baseClass = "app-config-form";
 
+const validateFormData = ({ serverURL }: IWebAddressFormData) => {
+  const errors: IWebAddressFormErrors = {};
+  if (!serverURL) {
+    errors.server_url = "Fleet server URL must be present";
+  } else if (
+    !validUrl({
+      url: serverURL,
+      protocols: ["http", "https"],
+      allowAnyLocalHost: true,
+    })
+  ) {
+    errors.server_url = `${serverURL} is not a valid URL`;
+  }
+
+  return errors;
+};
+
 const WebAddress = ({
   appConfig,
   handleSubmit,
@@ -33,33 +50,36 @@ const WebAddress = ({
   const { serverURL } = formData;
 
   const [formErrors, setFormErrors] = useState<IWebAddressFormErrors>({});
+
   const onInputChange = ({ name, value }: IFormField) => {
-    setFormData({ ...formData, [name]: value });
-    setFormErrors({});
+    const newFormData = { ...formData, [name]: value };
+    setFormData(newFormData);
+    const newErrs = validateFormData(newFormData);
+    // only set errors that are updates of existing errors
+    // new errors are only set onBlur
+    const errsToSet: Record<string, string> = {};
+    Object.keys(formErrors).forEach((k) => {
+      // @ts-ignore
+      if (newErrs[k]) {
+        // @ts-ignore
+        errsToSet[k] = newErrs[k];
+      }
+    });
+    setFormErrors(errsToSet);
   };
 
-  const validateForm = () => {
-    const errors: IWebAddressFormErrors = {};
-    if (!serverURL) {
-      errors.server_url = "Fleet server URL must be present";
-    } else if (
-      !validUrl({
-        url: serverURL,
-        protocols: ["http", "https"],
-        allowAnyLocalHost: true,
-      })
-    ) {
-      errors.server_url = `${serverURL} is not a valid URL`;
-    }
-
-    setFormErrors(errors);
+  const onInputBlur = () => {
+    setFormErrors(validateFormData(formData));
   };
 
-  const formInvalid = !!size(formErrors);
-
-  const onFormSubmit = (evt: React.MouseEvent<HTMLFormElement>) => {
+  const onFormSubmit = (evt: React.FormEvent<HTMLFormElement>) => {
     evt.preventDefault();
-    if (formInvalid) return;
+    // return null if there are errors
+    const errs = validateFormData(formData);
+    if (size(errs)) {
+      setFormErrors(errs);
+      return;
+    }
 
     // Formatting of API not UI
     const formDataToSubmit = {
@@ -87,7 +107,7 @@ const WebAddress = ({
             name="serverURL"
             value={serverURL}
             parseTarget
-            onBlur={validateForm}
+            onBlur={onInputBlur}
             error={formErrors.server_url}
             tooltip="The base URL of this instance for use in Fleet links."
             disabled={gitOpsModeEnabled}
@@ -98,7 +118,7 @@ const WebAddress = ({
               <Button
                 type="submit"
                 variant="brand"
-                disabled={formInvalid || disableChildren}
+                disabled={!!size(formErrors) || disableChildren}
                 className="button-wrap"
                 isLoading={isUpdatingSettings}
               >

From 3da6c59d7fa1dd9394fba70635e624b487f701d6 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 14:09:13 -0700
Subject: [PATCH 13/23] tweak backend validation logic

---
 server/service/validation_setup.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index d3d6a82925ea..edc35be0daa6 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -38,8 +38,9 @@ func ValidateServerURL(urlString string) error {
 			return errors.New(fleet.InvalidServerURLMsg)
 		}
 	} else {
+		// serverURL.Host doesn't contain the path in this case
 		// invalid scheme, permit only localhost URLs
-		if !strings.Contains(serverURL.Host, "localhost") {
+		if !strings.Contains(serverURL.Path, "localhost") {
 			return errors.New(fleet.InvalidServerURLMsg)
 		}
 	}

From 05e0c0676590c9df5b345ea796090ecdff7742b0 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Mon, 24 Mar 2025 17:15:25 -0700
Subject: [PATCH 14/23] Tune backend validation

---
 server/service/validation_setup.go | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index edc35be0daa6..897941ebecf0 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"net/url"
-	"strings"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -33,16 +32,12 @@ func ValidateServerURL(urlString string) error {
 		return err
 	}
 
-	if serverURL.Scheme == "https" || serverURL.Scheme == "http" {
-		if serverURL.Host == "" {
-			return errors.New(fleet.InvalidServerURLMsg)
-		}
-	} else {
-		// serverURL.Host doesn't contain the path in this case
-		// invalid scheme, permit only localhost URLs
-		if !strings.Contains(serverURL.Path, "localhost") {
-			return errors.New(fleet.InvalidServerURLMsg)
-		}
+	// scheme present, or "localhost" host. When no scheme, `url.Parse` incorreclty parses "localhost"
+	// as the scheme - obviously "localhost" not a scheme
+	// Since "localhost" host is the only case we want to allow no included scheme, for now, this
+	// works for us:
+	if !(serverURL.Scheme == "https" || serverURL.Scheme == "http" || serverURL.Scheme == "localhost") {
+		return errors.New(fleet.InvalidServerURLMsg)
 	}
 	return nil
 }

From 7d398171ccb1b31dbf203284816351365b4e195c Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Tue, 25 Mar 2025 10:04:30 -0700
Subject: [PATCH 15/23] manually parse URL

---
 server/service/validation_setup.go | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index 897941ebecf0..40639df89996 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"net/url"
+	"strings"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -27,17 +28,26 @@ func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.A
 }
 
 func ValidateServerURL(urlString string) error {
-	serverURL, err := url.Parse(urlString)
+	var parsed *url.URL
+	if !(strings.HasPrefix(urlString, "http://") || strings.HasPrefix(urlString, "https://")) {
+		parsed, err := url.Parse("https://" + urlString)
+		if err != nil {
+			return err
+		}
+		// localhost only acceptable host if no schem (protocol) provided
+		if parsed.Host != "localhost" {
+			return errors.New(fleet.InvalidServerURLMsg)
+		}
+	}
+
+	parsed, err := url.Parse(urlString)
 	if err != nil {
 		return err
 	}
-
-	// scheme present, or "localhost" host. When no scheme, `url.Parse` incorreclty parses "localhost"
-	// as the scheme - obviously "localhost" not a scheme
-	// Since "localhost" host is the only case we want to allow no included scheme, for now, this
-	// works for us:
-	if !(serverURL.Scheme == "https" || serverURL.Scheme == "http" || serverURL.Scheme == "localhost") {
+	// host required with scheme if provided
+	if parsed.Host == "" {
 		return errors.New(fleet.InvalidServerURLMsg)
 	}
+
 	return nil
 }

From 478820bac22ea90fc3475b0b6aa230c37692142e Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Tue, 25 Mar 2025 10:05:54 -0700
Subject: [PATCH 16/23] add todo

---
 server/service/validation_setup.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index 40639df89996..10cdb45cee7a 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -28,6 +28,7 @@ func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.A
 }
 
 func ValidateServerURL(urlString string) error {
+	// TODO - implement more robust URL validation here
 	var parsed *url.URL
 	if !(strings.HasPrefix(urlString, "http://") || strings.HasPrefix(urlString, "https://")) {
 		parsed, err := url.Parse("https://" + urlString)

From 9b7a2f47729042919a427d9af7068352b1f56c30 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Tue, 25 Mar 2025 10:57:49 -0700
Subject: [PATCH 17/23] adjust

---
 server/service/validation_setup.go | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index 10cdb45cee7a..6a12e5f8bfe2 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -29,18 +29,23 @@ func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.A
 
 func ValidateServerURL(urlString string) error {
 	// TODO - implement more robust URL validation here
-	var parsed *url.URL
+
+	// no valid scheme provided
 	if !(strings.HasPrefix(urlString, "http://") || strings.HasPrefix(urlString, "https://")) {
 		parsed, err := url.Parse("https://" + urlString)
 		if err != nil {
 			return err
 		}
-		// localhost only acceptable host if no schem (protocol) provided
-		if parsed.Host != "localhost" {
+		// localhost only acceptable host if no schem (protocol) provided. .Host will include port (e.g.
+		// 8080), so we check for "localhost" prefix
+		// by checking for prefix, we also invalidate unsupported schemes like "ftp://"
+		if !strings.HasPrefix(parsed.Host, "localhost") {
 			return errors.New(fleet.InvalidServerURLMsg)
 		}
+		return nil
 	}
 
+	// scheme provided
 	parsed, err := url.Parse(urlString)
 	if err != nil {
 		return err

From 30ba820d7c295d303a6e7d4f244a76a044490be1 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Tue, 25 Mar 2025 11:13:59 -0700
Subject: [PATCH 18/23] adjust

---
 server/service/validation_setup.go | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index 6a12e5f8bfe2..cc8e3c961676 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -32,14 +32,15 @@ func ValidateServerURL(urlString string) error {
 
 	// no valid scheme provided
 	if !(strings.HasPrefix(urlString, "http://") || strings.HasPrefix(urlString, "https://")) {
+		// left-append valid scheme to leverage `url.Parse`
 		parsed, err := url.Parse("https://" + urlString)
 		if err != nil {
 			return err
 		}
-		// localhost only acceptable host if no schem (protocol) provided. .Host will include port (e.g.
-		// 8080), so we check for "localhost" prefix
-		// by checking for prefix, we also invalidate unsupported schemes like "ftp://"
-		if !strings.HasPrefix(parsed.Host, "localhost") {
+		// "localhost" only acceptable host if no valid scheme (protocol) provided.
+		// Hostname() will pull out the substring directly after the left-appended scheme, excluding
+		// port. This has the added benefit of catching an invalid scheme provided (e.g. ftp) and will correctly invalidate
+		if parsed.Hostname() != "localhost" {
 			return errors.New(fleet.InvalidServerURLMsg)
 		}
 		return nil

From d9e830faaa2e3b8a272788b3992f2a9259d16637 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Tue, 25 Mar 2025 11:16:01 -0700
Subject: [PATCH 19/23] adjust

---
 server/service/validation_setup.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index cc8e3c961676..77858951fec8 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -46,7 +46,7 @@ func ValidateServerURL(urlString string) error {
 		return nil
 	}
 
-	// scheme provided
+	// valid scheme provided
 	parsed, err := url.Parse(urlString)
 	if err != nil {
 		return err

From 7e48d9324cae19f240f54cb9ffacfa6db9112113 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Tue, 25 Mar 2025 13:17:35 -0700
Subject: [PATCH 20/23] update backend validation per finalized specs

---
 server/fleet/errors.go             |  2 +-
 server/service/appconfig.go        |  2 +-
 server/service/validation_setup.go | 16 ++--------------
 3 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/server/fleet/errors.go b/server/fleet/errors.go
index 958193c4b180..deffb10ead44 100644
--- a/server/fleet/errors.go
+++ b/server/fleet/errors.go
@@ -629,7 +629,7 @@ const (
 	InvalidLabelSpecifiedErrMsg = "Invalid label name(s):"
 
 	// Config
-	InvalidServerURLMsg = "Server URL must use https or http scheme with valid host, or localhost."
+	InvalidServerURLMsg = `Fleet server URL must use “https” or “http”.`
 )
 
 // ConflictError is used to indicate a conflict, such as a UUID conflict in the DB.
diff --git a/server/service/appconfig.go b/server/service/appconfig.go
index 71b83484ff6d..7f4f9e3a01ea 100644
--- a/server/service/appconfig.go
+++ b/server/service/appconfig.go
@@ -419,7 +419,7 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 		invalid.Append("server_url", "Fleet server URL must be present")
 	} else {
 		if err := ValidateServerURL(appConfig.ServerSettings.ServerURL); err != nil {
-			invalid.Append("server_url", err.Error())
+			invalid.Append("server_url", "Couldn't update settings: "+err.Error())
 		}
 	}
 
diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index 77858951fec8..8b4a46d33bb6 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -32,26 +32,14 @@ func ValidateServerURL(urlString string) error {
 
 	// no valid scheme provided
 	if !(strings.HasPrefix(urlString, "http://") || strings.HasPrefix(urlString, "https://")) {
-		// left-append valid scheme to leverage `url.Parse`
-		parsed, err := url.Parse("https://" + urlString)
-		if err != nil {
-			return err
-		}
-		// "localhost" only acceptable host if no valid scheme (protocol) provided.
-		// Hostname() will pull out the substring directly after the left-appended scheme, excluding
-		// port. This has the added benefit of catching an invalid scheme provided (e.g. ftp) and will correctly invalidate
-		if parsed.Hostname() != "localhost" {
-			return errors.New(fleet.InvalidServerURLMsg)
-		}
-		return nil
+		return errors.New(fleet.InvalidServerURLMsg)
 	}
 
-	// valid scheme provided
+	// valid scheme provided - require host
 	parsed, err := url.Parse(urlString)
 	if err != nil {
 		return err
 	}
-	// host required with scheme if provided
 	if parsed.Host == "" {
 		return errors.New(fleet.InvalidServerURLMsg)
 	}

From d5ddf5e6c50a34ac10eea4754622d264457521a5 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Tue, 25 Mar 2025 14:11:11 -0700
Subject: [PATCH 21/23] Only allow Fleet server URLs with "https://" or
 "http://"

- Front and backend validation
- Any users with now invalid Fleet server URLs, e.g. "localhost:8080" (no protocol)
    now get an informative error whenever they try to change another setting
---
 .../FleetDetails/FleetDetails.tests.jsx       | 42 ++++++++++++++++++-
 .../RegistrationForm/FleetDetails/helpers.js  |  7 ++--
 .../forms/validators/valid_url/valid_url.ts   | 22 ++++++----
 .../cards/WebAddress/WebAddress.tsx           |  6 ++-
 frontend/utilities/error_messages.ts          |  3 ++
 5 files changed, 66 insertions(+), 14 deletions(-)
 create mode 100644 frontend/utilities/error_messages.ts

diff --git a/frontend/components/forms/RegistrationForm/FleetDetails/FleetDetails.tests.jsx b/frontend/components/forms/RegistrationForm/FleetDetails/FleetDetails.tests.jsx
index b06007841bbd..e447bfeaf31f 100644
--- a/frontend/components/forms/RegistrationForm/FleetDetails/FleetDetails.tests.jsx
+++ b/frontend/components/forms/RegistrationForm/FleetDetails/FleetDetails.tests.jsx
@@ -5,6 +5,8 @@ import { renderWithSetup } from "test/test-utils";
 
 import FleetDetails from "components/forms/RegistrationForm/FleetDetails";
 
+import INVALID_SERVER_URL_MESSAGE from "utilities/error_messages";
+
 describe("FleetDetails - form", () => {
   const handleSubmitSpy = jest.fn();
   it("renders", () => {
@@ -29,7 +31,30 @@ describe("FleetDetails - form", () => {
     ).toBeInTheDocument();
   });
 
-  it("submits the form when valid", async () => {
+  it("validates the Fleet server URL field starts with 'https://' or 'http://'", async () => {
+    const { user } = renderWithSetup(
+      <FleetDetails handleSubmit={handleSubmitSpy} currentPage />
+    );
+
+    const inputField = screen.getByRole("textbox", {
+      name: "Fleet web address",
+    });
+    const nextButton = screen.getByRole("button", { name: "Next" });
+
+    await user.type(inputField, "gnar.Fleet.co");
+    await user.click(nextButton);
+
+    expect(handleSubmitSpy).not.toHaveBeenCalled();
+    expect(screen.getByText(INVALID_SERVER_URL_MESSAGE)).toBeInTheDocument();
+
+    await user.type(inputField, "localhost:8080");
+    await user.click(nextButton);
+
+    expect(handleSubmitSpy).not.toHaveBeenCalled();
+    expect(screen.getByText(INVALID_SERVER_URL_MESSAGE)).toBeInTheDocument();
+  });
+
+  it("submits the form with valid https link", async () => {
     const { user } = renderWithSetup(
       <FleetDetails handleSubmit={handleSubmitSpy} currentPage />
     );
@@ -44,4 +69,19 @@ describe("FleetDetails - form", () => {
       server_url: "https://gnar.Fleet.co",
     });
   });
+  it("submits the form with valid http link", async () => {
+    const { user } = renderWithSetup(
+      <FleetDetails handleSubmit={handleSubmitSpy} currentPage />
+    );
+    // when
+    await user.type(
+      screen.getByRole("textbox", { name: "Fleet web address" }),
+      "http://localhost:8080"
+    );
+    await user.click(screen.getByRole("button", { name: "Next" }));
+    // then
+    expect(handleSubmitSpy).toHaveBeenCalledWith({
+      server_url: "http://localhost:8080",
+    });
+  });
 });
diff --git a/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js b/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
index 092d4e83f20f..d1c08acf1c7f 100644
--- a/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
+++ b/frontend/components/forms/RegistrationForm/FleetDetails/helpers.js
@@ -2,6 +2,8 @@ import { size } from "lodash";
 
 import validUrl from "components/forms/validators/valid_url";
 
+import INVALID_SERVER_URL_MESSAGE from "utilities/error_messages";
+
 const validate = (formData) => {
   const errors = {};
   const { server_url: fleetWebAddress } = formData;
@@ -12,11 +14,10 @@ const validate = (formData) => {
     !validUrl({
       url: fleetWebAddress,
       protocols: ["http", "https"],
-      allowAnyLocalHost: true,
+      allowLocalHost: true,
     })
   ) {
-    errors.server_url =
-      "Fleet web address must be a valid https, http, or localhost URL";
+    errors.server_url = INVALID_SERVER_URL_MESSAGE;
   }
 
   const valid = !size(errors);
diff --git a/frontend/components/forms/validators/valid_url/valid_url.ts b/frontend/components/forms/validators/valid_url/valid_url.ts
index 5ec9088da10c..49d4bd5f34ab 100644
--- a/frontend/components/forms/validators/valid_url/valid_url.ts
+++ b/frontend/components/forms/validators/valid_url/valid_url.ts
@@ -6,16 +6,22 @@ interface IValidUrl {
   url: string;
   /**  Validate protocols specified */
   protocols?: ("http" | "https")[];
-  allowAnyLocalHost?: boolean;
+  allowLocalHost?: boolean;
 }
 
-export default ({
-  url,
-  protocols,
-  allowAnyLocalHost = false,
-}: IValidUrl): boolean => {
-  if (allowAnyLocalHost && url.includes("localhost")) return true;
+export default ({ url, protocols, allowLocalHost }: IValidUrl) => {
   // this function also has a `require_valid_protocol` option, though as called it seems to already validate
   // that the URL's protocol is one of those specified
-  return isURL(url, { protocols, require_protocol: !!protocols?.length });
+  if (allowLocalHost) {
+    if (
+      url.startsWith("http://localhost") ||
+      url.startsWith("https://localhost")
+    ) {
+      return true;
+    }
+  }
+  return isURL(url, {
+    protocols,
+    require_protocol: !!protocols?.length,
+  });
 };
diff --git a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
index e3b8139d11bd..c8f61836bef1 100644
--- a/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
+++ b/frontend/pages/admin/OrgSettingsPage/cards/WebAddress/WebAddress.tsx
@@ -8,6 +8,8 @@ import validUrl from "components/forms/validators/valid_url";
 import SectionHeader from "components/SectionHeader";
 import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
 
+import INVALID_SERVER_URL_MESSAGE from "utilities/error_messages";
+
 import { IAppConfigFormProps, IFormField } from "../constants";
 
 interface IWebAddressFormData {
@@ -27,10 +29,10 @@ const validateFormData = ({ serverURL }: IWebAddressFormData) => {
     !validUrl({
       url: serverURL,
       protocols: ["http", "https"],
-      allowAnyLocalHost: true,
+      allowLocalHost: true,
     })
   ) {
-    errors.server_url = `${serverURL} is not a valid URL`;
+    errors.server_url = INVALID_SERVER_URL_MESSAGE;
   }
 
   return errors;
diff --git a/frontend/utilities/error_messages.ts b/frontend/utilities/error_messages.ts
new file mode 100644
index 000000000000..80c70e51bf75
--- /dev/null
+++ b/frontend/utilities/error_messages.ts
@@ -0,0 +1,3 @@
+const INVALID_SERVER_URL_MESSAGE = `Fleet server URL must use “https” or “http”.`;
+
+export default INVALID_SERVER_URL_MESSAGE;

From 312e7b2e69dabb3a9f31ba0f37f0d99381dc07db Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Tue, 25 Mar 2025 14:23:42 -0700
Subject: [PATCH 22/23] Update frontend error message to reflect actual
 validation conditions

---
 frontend/utilities/error_messages.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/utilities/error_messages.ts b/frontend/utilities/error_messages.ts
index 80c70e51bf75..e9086678a3de 100644
--- a/frontend/utilities/error_messages.ts
+++ b/frontend/utilities/error_messages.ts
@@ -1,3 +1,3 @@
-const INVALID_SERVER_URL_MESSAGE = `Fleet server URL must use “https” or “http”.`;
+const INVALID_SERVER_URL_MESSAGE = `Fleet server address must be a valid “https” or “http” URL.`;
 
 export default INVALID_SERVER_URL_MESSAGE;

From 96be402518cf24d8c2e40e992c2abd13d6664e73 Mon Sep 17 00:00:00 2001
From: Jacob Shandling <jacob@fleetdm.com>
Date: Thu, 27 Mar 2025 13:15:38 -0700
Subject: [PATCH 23/23] updates

---
 changes/27454-validation                            |  2 +-
 .../forms/validators/valid_url/valid_url.ts         | 13 ++-----------
 2 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/changes/27454-validation b/changes/27454-validation
index 41d6629fa8a8..fd08c518e385 100644
--- a/changes/27454-validation
+++ b/changes/27454-validation
@@ -1 +1 @@
-- Accept any string for the Fleet web URL
+- Accept any "http://" or "https://" prefixed Fleet web URL
diff --git a/frontend/components/forms/validators/valid_url/valid_url.ts b/frontend/components/forms/validators/valid_url/valid_url.ts
index 49d4bd5f34ab..4b94cd76ca40 100644
--- a/frontend/components/forms/validators/valid_url/valid_url.ts
+++ b/frontend/components/forms/validators/valid_url/valid_url.ts
@@ -9,19 +9,10 @@ interface IValidUrl {
   allowLocalHost?: boolean;
 }
 
-export default ({ url, protocols, allowLocalHost }: IValidUrl) => {
-  // this function also has a `require_valid_protocol` option, though as called it seems to already validate
-  // that the URL's protocol is one of those specified
-  if (allowLocalHost) {
-    if (
-      url.startsWith("http://localhost") ||
-      url.startsWith("https://localhost")
-    ) {
-      return true;
-    }
-  }
+export default ({ url, protocols, allowLocalHost = false }: IValidUrl) => {
   return isURL(url, {
     protocols,
     require_protocol: !!protocols?.length,
+    require_tld: !allowLocalHost,
   });
 };