anomalyco/sst · error · VisibleError

The listen protocol "${v.listen}" must match the redirect pr

Error message

The listen protocol "${v.listen}" must match the redirect protocol "${v.redirect}".

What it means

A redirect rule's listen protocol type (application vs network) must match its redirect protocol type — you cannot listen on a network protocol and redirect to an HTTP(S) URL or vice versa. `normalizeLoadBalancer` parses `redirect` as "port/protocol" and throws this `VisibleError` when the protocol types differ.

Source

Thrown at platform/src/components/aws/service.ts:1993

                ? {
                    path: v.conditions?.path ?? v.path,
                    query: v.conditions?.query,
                    header: v.conditions?.header,
                  }
                : undefined;
            if (protocolType(listenProtocol) === "network" && listenConditions)
              throw new VisibleError(
                `Invalid rule conditions for listen protocol "${v.listen}". Only "http" protocols support conditions.`,
              );

            const redirectParts = v.redirect?.split("/");
            const redirectPort = redirectParts && parseInt(redirectParts[0]);
            const redirectProtocol = redirectParts && redirectParts[1];
            if (redirectPort && redirectProtocol) {
              if (
                protocolType(listenProtocol) !== protocolType(redirectProtocol)
              )
                throw new VisibleError(
                  `The listen protocol "${v.listen}" must match the redirect protocol "${v.redirect}".`,
                );
              return {
                type: "redirect" as const,
                listenPort,
                listenProtocol,
                listenConditions,
                redirectPort,
                redirectProtocol,
              };
            }

            const forwardParts = v.forward ? v.forward.split("/") : listenParts;
            const forwardPort = forwardParts && parseInt(forwardParts[0]);
            const forwardProtocol = forwardParts && forwardParts[1];
            if (protocolType(listenProtocol) !== protocolType(forwardProtocol))
              throw new VisibleError(
                `The listen protocol "${v.listen}" must match the forward protocol "${v.forward}".`,

View on GitHub (pinned to a0bd20f762)

Solutions

1. Make the listen protocol the same type as the redirect protocol, e.g. `listen: "80/http"` with `redirect: "443/https"`.
2. For NLB (tcp/tls) rules, remove the `redirect` and handle redirection at the application layer.
3. Validate each rule's `listen` and `redirect` strings follow "<port>/<protocol>" with matching protocol families.

Example fix

// before
{ listen: "80/tcp", redirect: "443/https" }

// after
{ listen: "80/http", redirect: "443/https" }

const protoType = (p: string) => /^(https?)\//.test(p) ? "application" : "network";
for (const r of rules) {
  if (r.redirect) {
    const [port, proto] = r.redirect.split("/");
    if (parseInt(port) && proto && protoType(r.listen) !== protoType(r.redirect)) {
      throw new Error(`listen ${r.listen} and redirect ${r.redirect} protocol types differ`);
    }
  }
}

function redirectProtocolMatches(r: { listen: string; redirect: string }): boolean {
  const app = (p: string) => /^https?\//.test(p);
  return app(r.listen) === app(r.redirect);
}

try {
  const svc = new sst.aws.Service("Api", args);
} catch (e) {
  if (e instanceof VisibleError && e.message.includes("must match the redirect protocol")) {
    // fix listen to http/https matching the redirect
  } else throw e;
}

When it happens

Trigger: A rule such as `{ listen: "8080/tcp", redirect: "443/https" }` — protocol type of `redirect` (application) differs from `listen` (network).

Common situations: Setting up HTTP-to-HTTPS redirects and mistyping the listen protocol as tcp/tls; copying redirect rules between ALB and NLB services without adjusting protocols.

Related errors

• Invalid rule conditions for listen protocol "${v.listen}". O
• Cannot access `nodes.loadBalancer` when no public ports are
• You must provide the ports to expose via "loadBalancer.rules
• You must provide a container name in "loadBalancer.rules" wh
• Cannot access `nodes.loadBalancer` in dev mode.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/3e91b3bb57f59f97. Report an issue: GitHub.