{"record":{"id":"19bd5ad2abbbe7e4","repo":"golang/go","slug":"refusing-to-pass-credentials-to-insecure-url-s","errorCode":null,"errorMessage":"refusing to pass credentials to insecure URL: %s","messagePattern":"refusing to pass credentials to insecure URL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/web/http.go","lineNumber":243,"sourceCode":"\t\tcase \"\":\n\t\t\tif security != Insecure {\n\t\t\t\tpanic(\"should have returned after HTTPS failure\")\n\t\t\t}\n\t\tdefault:\n\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: unsupported\\n\", url.Redacted())\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"unsupported scheme: %s\", url.Redacted())\n\t\t}\n\n\t\tinsecure := new(urlpkg.URL)\n\t\t*insecure = *url\n\t\tinsecure.Scheme = \"http\"\n\t\tif insecure.User != nil && security != Insecure {\n\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: insecure credentials\\n\", insecure.Redacted())\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"refusing to pass credentials to insecure URL: %s\", insecure.Redacted())\n\t\t}\n\n\t\tres, err = fetch(insecure)\n\t\tif err == nil {\n\t\t\tfetched = insecure\n\t\t} else {\n\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: %v\\n\", insecure.Redacted(), err)\n\t\t\t}\n\t\t\t// HTTP failed, and we already tried HTTPS if applicable.\n\t\t\t// Report the error from the HTTP attempt.\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\t// Note: accepting a non-200 OK here, so people can serve a\n\t// meta import in their http 404 page.\n\tif cfg.BuildX {","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/web/http.go#L225-L261","documentation":"Returned by web.get after the HTTPS attempt failed and the code is preparing an HTTP fallback. If the URL carries embedded userinfo (url.User != nil) and security mode is not Insecure, the go command refuses to send those credentials over plain HTTP. This prevents leaking tokens/passwords onto the wire.","triggerScenarios":"A URL like 'https://user:token@host/m' whose HTTPS fetch failed, triggering the http:// fallback, while GOINSECURE does not cover the host. The userinfo would otherwise be retransmitted unencrypted.","commonSituations":"Embedding a deploy token in the module URL for a private proxy; using 'git+https' style authenticated URLs; environments where the HTTPS endpoint is down but HTTP is up.","solutions":["Add the host to GOINSECURE only if you accept the credential exposure (Insecure mode allows it) — generally avoid.","Move credentials out of the URL into GOAUTH (go 1.24+) or a .netrc, and use HTTPS.","Fix the HTTPS endpoint so the HTTP fallback is never attempted.","Remove the userinfo from the URL and authenticate via GOPROXY with a credential helper."],"exampleFix":"// before\nexport GOPROXY=https://user:token@proxy.corp,direct\n// HTTPS down → HTTP fallback refused with credentials\n\n// after — use GOAUTH instead\n// $GOPATH/config/goauth\n// basic host proxy.corp user pass\nexport GOPROXY=https://proxy.corp,direct","handlingStrategy":"validation","validationCode":"func assertNoCredentialsInURL(u *urlpkg.URL) error {\n    if u.User != nil {\n        return fmt.Errorf(\"URL %s embeds credentials; move to .netrc/GOAUTH\", u.Redacted())\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never embed user:pass in module/proxy URLs — use GOAUTH (go 1.24+) or .netrc.","Audit go.mod and env for '@' in URLs as a CI lint.","If credentials must travel over HTTP, document the explicit GOINSECURE opt-in and the threat."],"tags":["security","credentials","network","modules","tls"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}