{"record":{"id":"064f6ee7487af1ed","repo":"badges/shields","slug":"please-use-https","errorCode":null,"errorMessage":"please use https","messagePattern":"please use https","errorType":"validation","errorClass":"InvalidParameter","httpStatus":400,"severity":"error","filePath":"services/endpoint/endpoint.service.js","lineNumber":193,"sourceCode":"\n  constructor(...args) {\n    super(...args)\n    const config = configModule.util.toObject()\n    this._allowUnsecuredEndpointRequests =\n      config?.public?.allowUnsecuredEndpointRequests || false\n  }\n\n  async handle(namedParams, { url }) {\n    let protocol, hostname\n    try {\n      const parsedUrl = new URL(url)\n      protocol = parsedUrl.protocol\n      hostname = parsedUrl.hostname\n    } catch (e) {\n      throw new InvalidParameter({ prettyMessage: 'invalid url' })\n    }\n    if (protocol !== 'https:' && !this._allowUnsecuredEndpointRequests) {\n      throw new InvalidParameter({ prettyMessage: 'please use https' })\n    }\n    if (blockedDomains.some(domain => hostname.endsWith(domain))) {\n      throw new InvalidParameter({ prettyMessage: 'domain is blocked' })\n    }\n\n    const validated = await fetchEndpointData(this, {\n      url,\n      httpErrors,\n      validationPrettyErrorMessage: 'invalid properties',\n      includeKeys: true,\n    })\n\n    return this.constructor.render(validated)\n  }\n}\n","sourceCodeStart":175,"sourceCodeEnd":209,"githubUrl":"https://github.com/badges/shields/blob/766fd8bc89a90b8534dc573ab72dec30215ab1ec/services/endpoint/endpoint.service.js#L175-L209","documentation":"The endpoint service only allows https URLs unless unsecured endpoint requests are explicitly enabled server-side (_allowUnsecuredEndpointRequests). If the parsed protocol is not https: and that flag is false, it throws InvalidParameter with prettyMessage 'please use https'. This enforces secure transport for user-supplied endpoints.","triggerScenarios":"Calling /badge/endpoint with url=http://... (or any non-https scheme like ftp:) while the Shields instance does not allow unsecured endpoint requests.","commonSituations":"Self-hosted/internal services only exposed over http; copying an http URL from local development into the badge; enterprise instances where the allow-unsecured flag was never enabled.","solutions":["Serve the endpoint data over https and use the https URL in the badge","If you self-host Shields, enable the unsecured-endpoint-requests option (e.g. via the ALLOW_UNSECURED_ENDPOINT_REQUESTS-style config) only for trusted internal use","Proxy the http resource through an https endpoint you control"],"exampleFix":"// before\n/badge/endpoint?url=http://internal.example.com/status.json\n// after\n/badge/endpoint?url=https://internal.example.com/status.json","handlingStrategy":"validation","validationCode":"function isHttpsUrl(url) {\n  try { return new URL(url).protocol === 'https:' } catch { return false }\n}\n// if (!isHttpsUrl(cfg.url)) upgrade to https before requesting the badge","typeGuard":null,"tryCatchPattern":"try {\n  const badge = await getEndpointBadge({ url })\n} catch (e) {\n  if (e.prettyMessage === 'please use https') {\n    const upgraded = url.replace(/^http:/, 'https:')\n    // retry with upgraded, else surface configuration warning\n  } else throw e\n}","preventionTips":["Default to https:// URLs everywhere, including internal services behind TLS","Never copy http:// URLs from local dev into production badge configs","If an internal service lacks TLS, front it with a reverse proxy that terminates TLS","Only enable unsecured-endpoint-requests on trusted self-hosted instances"],"tags":["https","security","url","invalid-parameter"],"backgroundTag":"insecure-http-url-rejected","analyzedSha":"766fd8bc89a90b8534dc573ab72dec30215ab1ec","analyzedAt":"2026-08-30T01:40:27.499Z","schemaVersion":2},"datasetVersion":"2026-08-30T08:17:16.595Z"}