{"record":{"id":"07fb87996b8db89d","repo":"ory/hydra","slug":"can-not-serve-request-over-insecure-http","errorCode":null,"errorMessage":"can not serve request over insecure http","messagePattern":"can not serve request over insecure http","errorType":"http","errorClass":null,"httpStatus":502,"severity":"error","filePath":"oryx/tlsx/termination.go","lineNumber":50,"sourceCode":"\t\t_, network, err := net.ParseCIDR(rn)\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(err)\n\t\t}\n\t\tnetworks = append(networks, network)\n\t}\n\n\treturn negroni.HandlerFunc(func(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {\n\t\tif r.TLS != nil ||\n\t\t\tr.URL.Path == healthx.AliveCheckPath ||\n\t\t\tr.URL.Path == healthx.ReadyCheckPath ||\n\t\t\tr.URL.Path == prometheusx.MetricsPrometheusPath {\n\t\t\tnext(rw, r)\n\t\t\treturn\n\t\t}\n\n\t\tif len(networks) == 0 {\n\t\t\td.Logger().WithRequest(r).WithError(errors.New(\"TLS termination is not enabled\")).Error(\"Could not serve http connection\")\n\t\t\td.Writer().WriteErrorCode(rw, r, http.StatusBadGateway, errors.New(\"can not serve request over insecure http\"))\n\t\t\treturn\n\t\t}\n\n\t\tif err := matchesRange(r, networks); err != nil {\n\t\t\td.Logger().WithRequest(r).WithError(err).Warnln(\"Could not serve http connection\")\n\t\t\td.Writer().WriteErrorCode(rw, r, http.StatusBadGateway, errors.New(\"can not serve request over insecure http\"))\n\t\t\treturn\n\t\t}\n\n\t\tproto := r.Header.Get(\"X-Forwarded-Proto\")\n\t\tif proto == \"\" {\n\t\t\td.Logger().WithRequest(r).WithError(errors.New(\"X-Forwarded-Proto header is missing\")).Error(\"Could not serve http connection\")\n\t\t\td.Writer().WriteErrorCode(rw, r, http.StatusBadGateway, errors.New(\"can not serve request over insecure http\"))\n\t\t\treturn\n\t\t} else if proto != \"https\" {\n\t\t\td.Logger().WithRequest(r).WithError(errors.New(\"X-Forwarded-Proto header is missing\")).Error(\"Could not serve http connection\")\n\t\t\td.Writer().WriteErrorCode(rw, r, http.StatusBadGateway, errors.Errorf(\"expected X-Forwarded-Proto header to be https but got: %s\", proto))\n\t\t\treturn","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/termination.go#L32-L68","documentation":"The TLS termination middleware rejects requests that arrive over plain HTTP when no trusted termination networks are configured. Because TLS termination is not enabled, the proxy cannot verify that the connection was secured upstream, so it responds 502 Bad Gateway with this message and logs 'TLS termination is not enabled'.","triggerScenarios":"An HTTP request reaches the middleware while the terminator allowlist is empty (len(networks) == 0) — i.e. the middleware was installed but no trusted CIDR ranges for TLS-terminating proxies were configured.","commonSituations":"Deploying behind a load balancer (AWS ELB, Cloudflare, nginx) that terminates TLS but forgetting to configure the proxy's IP ranges; running the service on http:// during local development while the middleware is enabled; misread environment/config causing the networks list to load empty.","solutions":["Configure the trusted TLS-termination proxy networks (CIDR ranges) so the middleware accepts forwarded connections","If TLS termination is not used, serve over HTTPS directly or skip installing the termination middleware","Ensure the proxy's source IP actually falls within the configured networks","For local development, run with HTTPS or disable the middleware"],"exampleFix":"// before\n// termination middleware enabled, no networks configured -> 502\n// after\nerr := d.TerminationMiddleware([]string{\"10.0.0.0/8\"})(next).ServeHTTP(rw, r) // trust internal LB range","handlingStrategy":"try-catch","validationCode":"if !tlsTerminationEnabled && requestIsHTTP {\n\t// do not install the termination middleware, or configure networks first\n}","typeGuard":"func isTerminationRejection(status int) bool {\n\treturn status == http.StatusBadGateway // middleware responds 502 with \"can not serve request over insecure http\"\n}","tryCatchPattern":"// client side\nresp, err := http.Get(url)\nif err == nil && resp.StatusCode == http.StatusBadGateway {\n\tbody, _ := io.ReadAll(resp.Body)\n\tif strings.Contains(string(body), \"insecure http\") {\n\t\t// switch to HTTPS or route via the trusted TLS-terminating proxy\n\t}\n}","preventionTips":["When deploying behind a TLS-terminating LB, always configure the trusted proxy CIDR networks","For local dev, run HTTPS or skip the termination middleware","Monitor for 502 responses with this message as a signal of missing termination config"],"tags":["go","http","tls","middleware","proxy"],"backgroundTag":"insecure-http-rejected","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}