Hmbown/CodeWhale · error

Using insecure HTTP base URL because {ALLOW_INSECURE_HTTP_EN

Error message

Using insecure HTTP base URL because {ALLOW_INSECURE_HTTP_ENV} is set

What it means

validate_base_url_security accepts https and loopback http URLs outright; for any other http:// base URL it warns (this message) only when ALLOW_INSECURE_HTTP_ENV (or its legacy alias) is set to 1/true-style values, and otherwise rejects the configuration. The message documents that the caller has explicitly opted into plaintext HTTP to a non-loopback endpoint — a deliberate security relaxation, not a malfunction.

Source

Thrown at crates/tui/src/client.rs:674

fn validate_base_url_security(base_url: &str) -> Result<()> {
    let display_base_url = redact_url_for_display(base_url);
    if base_url.starts_with("https://")
        || base_url.starts_with("http://localhost")
        || base_url.starts_with("http://127.0.0.1")
        || base_url.starts_with("http://[::1]")
    {
        return Ok(());
    }

    if base_url.starts_with("http://")
        && std::env::var(ALLOW_INSECURE_HTTP_ENV)
            .or_else(|_| std::env::var(LEGACY_ALLOW_INSECURE_HTTP_ENV))
            .ok()
            .as_deref()
            .is_some_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
    {
        logging::warn(format!(
            "Using insecure HTTP base URL because {ALLOW_INSECURE_HTTP_ENV} is set"
        ));
        return Ok(());
    }

    if base_url.starts_with("http://") {
        anyhow::bail!(
            "Refusing insecure base URL '{display_base_url}'.\n\
             \n\
             Loopback hosts (localhost, 127.0.0.1, [::1]) are auto-allowed.\n\
             For other trusted local hosts (LAN, llama.cpp on a private IP, etc.)\n\
             set the env var `{ALLOW_INSECURE_HTTP_ENV}=1` in the shell that runs codewhale and re-run.\n\
             \n\
             Example: `{ALLOW_INSECURE_HTTP_ENV}=1 codewhale` (note the underscores).",
        );
    }

    anyhow::bail!(

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Prefer an https:// base URL; the warning disappears once TLS is used
2. Use http://localhost / 127.0.0.1 / [::1] for local development without the env var
3. Remove ALLOW_INSECURE_HTTP_ENV in production; keep it only for trusted networks or test rigs

When it happens

Trigger: Thrown at crates/tui/src/client.rs:674 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/ced16b9c9d3b2d00. Report an issue: GitHub.