JuliusBrussee/caveman · error

ssrf: managed mode requires port 443

Error message

ssrf: managed mode requires port 443

What it means

Error "ssrf: managed mode requires port 443" thrown in JuliusBrussee/caveman.

Source

Thrown at shared/platform/ssrf/ssrf.go:178

	u, err := url.Parse(raw)
	if err != nil {
		// net/url.Error includes the raw URL (and may therefore include
		// credentials or query secrets). Keep this error field-only and stable.
		return errors.New("ssrf: invalid URL")
	}
	if u.Scheme != "https" && !(u.Scheme == "http" && !cfg.ManagedMode) {
		return fmt.Errorf("ssrf: scheme %q not permitted (managed mode requires https)", u.Scheme)
	}
	if u.User != nil {
		return fmt.Errorf("ssrf: credentials embedded in URL are forbidden")
	}
	host := u.Hostname()
	if host == "" {
		return fmt.Errorf("ssrf: URL must contain a host")
	}
	port := u.Port()
	if cfg.ManagedMode && port != "" && port != "443" {
		return errors.New("ssrf: managed mode requires port 443")
	}
	if port == "" {
		if u.Scheme == "https" {
			port = "443"
		} else {
			port = "80"
		}
	}
	return validateHostPort(ctx, host, port, cfg)
}

// ValidateHost resolves host (bare hostname or IP literal) and checks all
// resolved addresses.  Use when you have a host/port pair rather than a full
// URL.
func ValidateHost(ctx context.Context, host string, cfg Config) error {
	return validateHostPort(ctx, host, "", cfg)
}

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Use port 443 in managed mode.

When it happens

Trigger: Thrown at shared/platform/ssrf/ssrf.go:178 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/5f6724883f5fc103. Report an issue: GitHub.