apache/flink · error · IllegalArgumentException

Artifact fetching from raw HTTP endpoints are disabled. Set

Error message

Artifact fetching from raw HTTP endpoints are disabled. Set the '%s' property to override.

What it means

Thrown when an artifact URI uses the 'http' scheme but raw HTTP fetching is disabled by default (ArtifactFetchOptions.RAW_HTTP_ENABLED is false). Flink only allows https by default for security; plain http must be explicitly opted in. The message names the configuration key needed to override.

Source

Thrown at flink-clients/src/main/java/org/apache/flink/client/program/artifact/ArtifactFetchManager.java:160

    }

    private File fetchArtifact(String uri) throws Exception {
        URI resolvedUri = PackagedProgramUtils.resolveURI(uri);
        File targetFile = new File(baseDir, FilenameUtils.getName(resolvedUri.getPath()));
        if (targetFile.exists()) {
            // Already fetched user artifacts are kept.
            return targetFile;
        }

        return getFetcher(resolvedUri).fetch(uri, conf, baseDir);
    }

    private boolean isRawHttp(String uriScheme) {
        if ("http".equals(uriScheme)) {
            if (conf.get(ArtifactFetchOptions.RAW_HTTP_ENABLED)) {
                return true;
            }
            throw new IllegalArgumentException(
                    String.format(
                            "Artifact fetching from raw HTTP endpoints are disabled. Set the '%s' property to override.",
                            ArtifactFetchOptions.RAW_HTTP_ENABLED.key()));
        }

        return false;
    }

    /** Artifact fetch result with all fetched artifact(s). */
    public static class Result {

        private final File jobJar;
        private final List<File> artifacts;

        private Result(@Nullable File jobJar, @Nullable List<File> additionalJars) {
            this.jobJar = jobJar;
            this.artifacts = additionalJars == null ? Collections.emptyList() : additionalJars;
        }

View on GitHub (pinned to 2f3c205e92)

Solutions

Use https:// URIs for artifacts if possible (recommended).
If plain HTTP is required (e.g., internal registry), set ArtifactFetchOptions.RAW_HTTP_ENABLED=true in the cluster/job configuration.
For local files, use the 'local' scheme or a file path instead of http.
For distributed filesystems, use the appropriate scheme (hdfs://, s3://, etc.).

Example fix

# before: plain http artifact URI
flink run --python http://my-registry/job.py

# after: enable raw http or use https
# option 1: enable raw http
config.set("artifact-fetch.raw-http-enabled", "true")
# option 2: use https
flink run --python https://my-registry/job.py

Defensive patterns

Strategy: validation

Validate before calling

URI uri = URI.create(artifactUri);
if ("http".equalsIgnoreCase(uri.getScheme())
        && !conf.get(ArtifactFetchOptions.RAW_HTTP_ENABLED)) {
    throw new IllegalArgumentException(
        "Raw HTTP artifacts disabled. Use https or set "
            + ArtifactFetchOptions.RAW_HTTP_ENABLED.key());
}

Try / catch

try {
    fetchManager.fetchArtifacts(uris);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("raw HTTP endpoints are disabled")) {
        // switch to https or enable raw http
    }
    throw e;
}

Prevention

Prefer https:// for all artifact URIs.
If plain HTTP is unavoidable, explicitly set ArtifactFetchOptions.RAW_HTTP_ENABLED=true.
Use local file paths or filesystem schemes (hdfs, s3) where appropriate.

When it happens

Trigger: Submitting a job with an artifact URI starting with 'http://' (not https) while ArtifactFetchOptions.RAW_HTTP_ENABLED is not set to true. The check happens in isRawHttp when selecting the fetcher for the URI scheme.

Common situations: Internal HTTP artifact registry without TLS, or a local development environment using plain HTTP. Production setups typically use HTTPS and never hit this.

Related errors

AI-assisted analysis of apache/flink@2f3c205e92 (2026-08-14). Data as JSON: /api/errors/73725231a2ad16be. Report an issue: GitHub.