{"record":{"id":"07f012cb0a0a59d1","repo":"langchain-ai/deepagents","slug":"marketplace-response-must-use-https-detail","errorCode":null,"errorMessage":"Marketplace response must use https: {detail}","messagePattern":"Marketplace response must use https: (.+?)","errorType":"exception","errorClass":"MarketplaceError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/plugins/marketplace.py","lineNumber":377,"sourceCode":"def _download_marketplace(url: str) -> Path:\n    parsed = urlparse(url)\n    if parsed.scheme != \"https\":\n        msg = f\"Marketplace URL must use https: {_redact_url_credentials(url)}\"\n        raise MarketplaceError(msg)\n    cache_path = (\n        ensure_marketplace_cache_dir() / f\"marketplace-url-{opaque_cache_key(url)}.json\"\n    )\n    request = urllib.request.Request(  # noqa: S310  # Scheme is restricted above.\n        url, headers={\"User-Agent\": \"dcode-plugin-manager\"}\n    )\n    opener = urllib.request.build_opener(_HttpsOnlyRedirectHandler())\n    try:\n        with opener.open(request, timeout=10) as response:\n            final_url = response.geturl()\n            if urlparse(final_url).scheme != \"https\":\n                detail = _redact_url_credentials(final_url)\n                msg = f\"Marketplace response must use https: {detail}\"\n                raise MarketplaceError(msg)\n            data = json.load(response)\n    except (OSError, urllib.error.URLError, json.JSONDecodeError) as exc:\n        msg = (\n            \"Failed to download marketplace from \"\n            f\"{_redact_url_credentials(url)}: {redact_urls_in_text(str(exc))}\"\n        )\n        raise MarketplaceError(msg) from exc\n    if not isinstance(data, dict):\n        msg = (\n            f\"Marketplace URL must return a JSON object: {_redact_url_credentials(url)}\"\n        )\n        raise MarketplaceError(msg)\n    cache_path.parent.mkdir(parents=True, exist_ok=True)\n    cache_path.write_text(\n        json.dumps(data, indent=2, sort_keys=True) + \"\\n\", encoding=\"utf-8\"\n    )\n    return cache_path\n","sourceCodeStart":359,"sourceCodeEnd":395,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/plugins/marketplace.py#L359-L395","documentation":"After _download_marketplace completes the HTTP request, it checks the final (post-redirect) response URL and requires it to be https. This catches cases where the initial URL was https but the server silently redirected to a non-https endpoint, preventing a downgrade even mid-chain.","triggerScenarios":"Requesting an https:// marketplace URL where the server returns a redirect whose final response.geturl() is not https (e.g. https host redirecting to http CDN).","commonSituations":"TLS-terminating proxy forwards to http backend; misconfigured hosting that 301s https traffic to http; a marketplace file moved to a new plain-HTTP host.","solutions":["Make the final redirect destination use https://","Remove the redirect and serve the catalog at the original https URL","Check the response chain with curl -sIL <url> and fix the hop that drops TLS"],"exampleFix":"# diagnose\n$ curl -sIL https://example.com/marketplace.json | grep -i location\n# before\nlocation: http://cdn.example.com/marketplace.json\n// after\nlocation: https://cdn.example.com/marketplace.json","handlingStrategy":"try-catch","validationCode":"import urllib.request\nfrom urllib.parse import urlparse\nreq = urllib.request.Request(url, method=\"HEAD\")\nwith urllib.request.urlopen(req) as resp:\n    assert urlparse(resp.geturl()).scheme == \"https\", \"final URL not https\"","typeGuard":"def final_url_is_https(url: str) -> bool:\n    import urllib.request\n    from urllib.parse import urlparse\n    with urllib.request.urlopen(url) as r:\n        return urlparse(r.geturl()).scheme == \"https\"","tryCatchPattern":"try:\n    marketplace, path = materialize_marketplace_source(source)\nexcept MarketplaceError as exc:\n    if \"response must use https\" in str(exc):\n        log.error(\"Marketplace redirect chain exits TLS at %s\", exc)\n    raise","preventionTips":["Verify the full redirect chain stays on https before publishing a marketplace","Avoid hosts known to redirect to http","Monitor server configs for TLS-terminating proxies"],"tags":["network","security","https","redirect"],"backgroundTag":"insecure-redirect-downgrade","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}