Budibase/budibase · error · Error

Plugin URL must use HTTPS.

Error message

Plugin URL must use HTTPS.

What it means

Thrown when the plugin tarball URL parses but does not use the https: protocol. Budibase requires HTTPS for remote plugin downloads so code is not fetched over plaintext.

Source

Thrown at packages/server/src/api/controllers/plugin/url.ts:16

import { downloadUnzipTarball } from "./utils"
import {
  deleteFolderFileSystem,
  getPluginMetadata,
} from "../../../utilities/fileSystem"

function parseTarGzUrl(url: string): URL {
  let parsed: URL
  try {
    parsed = new URL(url)
  } catch {
    throw new Error("Invalid plugin URL.")
  }

  if (parsed.protocol !== "https:") {
    throw new Error("Plugin URL must use HTTPS.")
  }

  if (!parsed.pathname.endsWith(".tar.gz")) {
    throw new Error("Plugin must be compressed into a gzipped tarball.")
  }

  return parsed
}

export async function urlUpload(url: string, name = "", headers = {}) {
  parseTarGzUrl(url)

  const path = await downloadUnzipTarball(url, name, headers, {
    followRedirects: false,
  })
  try {
    return await getPluginMetadata(path)
  } catch (err) {

View on GitHub (pinned to a81a902e9a)

Solutions

1. Serve the tarball over HTTPS (add TLS via a reverse proxy or Let's Encrypt)
2. Use an HTTPS-capable host (e.g. GitHub releases, S3 with TLS)
3. If purely internal, front the file server with an HTTPS proxy

Example fix

// before
await urlUpload('http://files.example.com/plugin.tar.gz')
// after
await urlUpload('https://files.example.com/plugin.tar.gz')

const u = new URL(url)
if (u.protocol !== 'https:') throw new Error('Plugin URL must start with https://')

function isHttpsUrl(url: string): boolean {
  try { return new URL(url).protocol === 'https:' } catch { return false }
}

try {
  await urlUpload(url)
} catch (err) {
  if (err.message === 'Plugin URL must use HTTPS.') {
    // switch the host to an HTTPS endpoint
  }
}

When it happens

Trigger: urlUpload called with an http:// URL for a .tar.gz plugin archive.

Common situations: Self-hosted file servers still on plain HTTP; old documentation links using http; internal network hosts without TLS.

Related errors

• Only HTTP(S) URLs are allowed.
• URL must not include credentials.
• Invalid plugin URL.
• Plugin must be compressed into a gzipped tarball.
• REST query path must remain on the datasource origin

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/f05bdbf6902cb9de. Report an issue: GitHub.