{"record":{"id":"022ed23bcd02a63f","repo":"badges/shields","slug":"strict-ssl-is-required","errorCode":null,"errorMessage":"strict ssl is required","messagePattern":"strict ssl is required","errorType":"validation","errorClass":"InvalidParameter","httpStatus":null,"severity":"error","filePath":"core/base-service/auth-helper.js","lineNumber":94,"sourceCode":"    if (this.isRequired) {\n      return this.isConfigured\n    } else {\n      const configIsEmpty = !this._user && !this._pass\n      return this.isConfigured || configIsEmpty\n    }\n  }\n\n  static _isInsecureSslRequest({ options = {} }) {\n    const strictSSL = options?.https?.rejectUnauthorized ?? true\n    return strictSSL !== true\n  }\n\n  enforceStrictSsl({ options = {} }) {\n    if (\n      this._requireStrictSsl &&\n      this.constructor._isInsecureSslRequest({ options })\n    ) {\n      throw new InvalidParameter({ prettyMessage: 'strict ssl is required' })\n    }\n  }\n\n  isAllowedOrigin(url) {\n    let parsed\n    try {\n      parsed = new URL(url)\n    } catch (e) {\n      throw new InvalidParameter({ prettyMessage: 'invalid url parameter' })\n    }\n\n    const { protocol, host } = parsed\n    const origin = `${protocol}//${host}`\n    return this._authorizedOrigins.includes(origin)\n  }\n\n  shouldAuthenticateRequest({ url, options = {} }) {\n    const originViolation = !this.isAllowedOrigin(url)","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/badges/shields/blob/766fd8bc89a90b8534dc573ab72dec30215ab1ec/core/base-service/auth-helper.js#L76-L112","documentation":"This error is thrown by AuthHelper's enforceStrictSsl when the service requires strict SSL (`_requireStrictSsl` is true) and the outgoing request options indicate an insecure SSL connection (e.g. http:// protocol or `rejectUnauthorized: false`), detected via the static `_isInsecureSslRequest({ options })` check. It is raised from `_withAnyAuth`, the shared entry point for all auth-merging helpers (withBasicAuth, withApiKeyHeader, withBearerAuthHeader, withQueryStringAuth, withJwtAuth), before any credentials are attached. Shields.sh refuses to send credentials over a connection it considers insecure when the service declares strict SSL.","triggerScenarios":"Calling any auth wrapper (withBasicAuth/withApiKeyHeader/withBearerAuthHeader/withQueryStringAuth/withJwtAuth) with request params whose URL uses http:// instead of https://, or with got options disabling TLS verification (`https: { rejectUnauthorized: false }`), while the service class sets `requireStrictSsl = true` (or `_requireStrictSsl` resolves true).","commonSituations":"Self-hosted instance configs pointing at an internal http:// endpoint; developers disabling cert validation to work around self-signed certificates; misconfigured service subclasses that default to http; test/staging URLs pasted into config.","solutions":["Switch the request/target URL from http:// to https:// so `_isInsecureSslRequest` returns false","Remove any `rejectUnauthorized: false` (or equivalent insecure TLS option) from the request options","If the endpoint genuinely cannot do TLS, fix the certificate/server side rather than disabling strict SSL","Only if explicitly intended for a trusted internal network, set the service's `requireStrictSsl`/`_requireStrictSsl` to false in the service subclass"],"exampleFix":"// before\nconst { buffer } = await fetchWithBasicAuth({ url: 'http://self-hosted.internal/api', options: { https: { rejectUnauthorized: false } } })\n// after\nconst { buffer } = await fetchWithBasicAuth({ url: 'https://self-hosted.internal/api' })","handlingStrategy":"validation","validationCode":"function assertSecureRequest(url, options = {}) {\n  const u = new URL(url)\n  const tlsDisabled = options.https?.rejectUnauthorized === false\n  if (u.protocol !== 'https:' || tlsDisabled) {\n    throw new Error(`strict ssl is required: ${u.protocol} request or TLS verification disabled`)\n  }\n}\n// call before any withBasicAuth/withJwtAuth etc.\nassertSecureRequest(targetUrl, requestOptions)","typeGuard":"function isInsecureSslRequest({ options = {}, url }) {\n  try { return new URL(url).protocol !== 'https:' || options.https?.rejectUnauthorized === false } catch { return true }\n}\nif (!isInsecureSslRequest({ url, options })) { /* safe to authenticate */ }","tryCatchPattern":"try {\n  const params = service.withBasicAuth(requestParams)\n} catch (err) {\n  if (err.prettyMessage === 'strict ssl is required') {\n    // upgrade URL to https or remove rejectUnauthorized:false, then retry\n  } else throw err\n}","preventionTips":["Always use https:// URLs for authenticated endpoints","Never pass https.rejectUnauthorized: false in production code; fix certificates instead","Keep requireStrictSsl enabled unless the service is explicitly internal-only","Lint config files for http:// URLs before deployment"],"tags":["ssl","security","auth","invalid-parameter"],"backgroundTag":"insecure-ssl-request-blocked","analyzedSha":"766fd8bc89a90b8534dc573ab72dec30215ab1ec","analyzedAt":"2026-08-30T01:40:27.499Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}