XTLS/Xray-core · error

scheme must be https

Error message

scheme must be https

What it means

Thrown by validateHTTPS in infra/conf/geodata.go when a URL parses successfully but its scheme is not exactly 'https' or its host is empty. This helper guards geodata asset download URLs (and is reached via error 283's wrapper). It enforces that all geodata downloads go over TLS to a named host.

Source

Thrown at infra/conf/geodata.go:37

	if err := validateHTTPS(c.URL); err != nil {
		return nil, errors.New("invalid geodata asset url: ", c.URL).Base(err)
	}
	if _, err := filesystem.StatAsset(c.File); err != nil {
		return nil, errors.New("invalid geodata asset file: ", c.File).Base(err)
	}
	return &geodata.Asset{
		Url:  c.URL,
		File: c.File,
	}, nil
}

func validateHTTPS(s string) error {
	u, err := url.ParseRequestURI(s)
	if err != nil {
		return err
	}
	if u.Scheme != "https" || u.Host == "" {
		return errors.New("scheme must be https")
	}
	return nil
}

type GeodataConfig struct {
	Cron     *string               `json:"cron"`
	Outbound string                `json:"outbound"`
	Assets   []*GeodataAssetConfig `json:"assets"`
}

func (c *GeodataConfig) Build() (proto.Message, error) {
	config := &geodata.Config{}

	if c.Cron != nil {
		if _, err := cron.ParseStandard(*c.Cron); err != nil {
			return nil, errors.New("invalid geodata cron").Base(err)
		}
		config.Cron = *c.Cron

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Change the URL scheme to https and include a host name
2. If the source only offers http, mirror the file on an https endpoint (e.g. your own server or an https-capable CDN) before referencing it

Example fix

// before
"url": "http://example.com/geoip.dat"
// after
"url": "https://example.com/geoip.dat"

u, err := url.Parse(rawURL)
if err != nil || u.Scheme != "https" || u.Host == "" {
	return errors.New("URL must use https with a host")
}

When it happens

Trigger: A geodata asset url like 'http://example.com/x.dat', 'ftp://example.com/x.dat', or 'https:///path-only' (https scheme but empty host). Also triggered indirectly by any other config field that routes through validateHTTPS.

Common situations: Using an http mirror because the https mirror is blocked or slow; URL strings that parse but lack a host component; config generators emitting scheme-less or http URLs.

Related errors

• failed to check code
• no valid ip matcher
• illegal ip rule:
• illegal domain rule:
• invalid geodata asset url:

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/a0ef064c73b4e468. Report an issue: GitHub.