{"record":{"id":"38ad36436ace6b3e","repo":"tursodatabase/turso","slug":"auth-token-requires-https-sync-requests-unless-the","errorCode":null,"errorMessage":"Auth Token requires HTTPS sync requests unless the host is localhost or loopback.","messagePattern":"Auth Token requires HTTPS sync requests unless the host is localhost or loopback\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"bindings/dotnet/src/Turso.Data/TursoSyncDatabase.cs","lineNumber":766,"sourceCode":"            _operationLock.Release();\n        }\n    }\n\n    internal static void ValidateAuthTransport(\n        Uri requestUri,\n        Uri configuredRemoteUri,\n        string? authToken)\n    {\n        if (string.IsNullOrWhiteSpace(authToken))\n            return;\n        if (!HasSameOrigin(requestUri, configuredRemoteUri))\n        {\n            throw new InvalidOperationException(\n                \"Refusing to send the sync auth token to an origin other than the configured remote.\");\n        }\n        if (requestUri.Scheme != Uri.UriSchemeHttps && !requestUri.IsLoopback)\n        {\n            throw new InvalidOperationException(\n                \"Auth Token requires HTTPS sync requests unless the host is localhost or loopback.\");\n        }\n    }\n\n    private static bool HasSameOrigin(Uri left, Uri right)\n    {\n        return left.Scheme.Equals(right.Scheme, StringComparison.OrdinalIgnoreCase)\n               && left.IdnHost.Equals(right.IdnHost, StringComparison.OrdinalIgnoreCase)\n               && left.Port == right.Port;\n    }\n\n    private static Uri NormalizeRemoteUri(Uri uri)\n    {\n        var scheme = uri.Scheme.ToLowerInvariant() switch\n        {\n            \"turso\" or \"libsql\" => Uri.UriSchemeHttps,\n            \"http\" => Uri.UriSchemeHttp,\n            \"https\" => Uri.UriSchemeHttps,","sourceCodeStart":748,"sourceCodeEnd":784,"githubUrl":"https://github.com/tursodatabase/turso/blob/6c7252267988c76e632af00a671e4b9788dfae13/bindings/dotnet/src/Turso.Data/TursoSyncDatabase.cs#L748-L784","documentation":"ValidateAuthTransport enforces that when an AuthToken is configured, sync HTTP requests use HTTPS unless the target host is localhost/loopback. This prevents the bearer token from being sent in cleartext over the network.","triggerScenarios":"Syncing with AuthToken set while the effective requestUri scheme is http and the host is not loopback (e.g. remote set to http://myserver.example.com, or a turso:// remote resolved to plain http, or an http redirect target).","commonSituations":"Pointing the remote at a staging/self-hosted server over plain http; using http:// in local config files deployed to production; a proxy or redirect downgrading https to http.","solutions":["Change the remote URI scheme to https (or use turso:// or libsql://, which normalize to https)","If this is truly local, use localhost or a 127.0.0.1/::1 address so the loopback exemption applies","Set up TLS on the sync server (e.g. a reverse proxy terminating TLS)","Remove the AuthToken only if the endpoint genuinely requires no authentication"],"exampleFix":"// before\nvar options = new TursoSyncDatabaseOptions(path, new Uri(\"http://my-turso-server.example.com\")) { AuthToken = token };\n// after\nvar options = new TursoSyncDatabaseOptions(path, new Uri(\"https://my-turso-server.example.com\")) { AuthToken = token };","handlingStrategy":"validation","validationCode":"bool TokenTransportIsSecure(Uri remote, string? authToken) =>\n    string.IsNullOrWhiteSpace(authToken) || remote.Scheme == Uri.UriSchemeHttps || remote.IsLoopback;\n// check before constructing options:\n// if (!TokenTransportIsSecure(remoteUri, token)) throw new ArgumentException(\"Use https or loopback for token sync.\");","typeGuard":null,"tryCatchPattern":"try\n{\n    await db.SyncAsync(ct);\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"requires HTTPS\"))\n{\n    logger.LogError(ex, \"Auth token would be sent over plain HTTP; refusing.\");\n    throw;\n}","preventionTips":["Always use https:// (or turso://, libsql://) remotes in configuration; reserve http:// for loopback-only local testing","Lint config files for http:// remotes before deploying","Terminate TLS at the server or reverse proxy instead of downgrading to http"],"tags":["dotnet","sync","security","https","auth-token"],"backgroundTag":"insecure-transport-auth-token","analyzedSha":"6c7252267988c76e632af00a671e4b9788dfae13","analyzedAt":"2026-08-31T11:17:35.598Z","contentChangedAt":"2026-08-31T11:17:35.598Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}