{"record":{"id":"4171a1f51775741e","repo":"zeroclaw-labs/zeroclaw","slug":"refusing-to-transmit-sensitive-data-over-non-https-4171a1","errorCode":null,"errorMessage":"Refusing to transmit sensitive data over non-HTTPS URL: URL scheme must be https","messagePattern":"Refusing to transmit sensitive data over non-HTTPS URL: URL scheme must be https","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-channels/src/whatsapp.rs","lineNumber":160,"sourceCode":"            zeroclaw_api::channel::AttributedApprovalResponse::from_runtime(\n                ChannelApprovalResponse::Deny,\n                zeroclaw_api::channel::ApprovalSource::Unreachable,\n            )\n        }\n        Err(_) => {\n            remove_pending_and_disarm(&token, &mut guard).await;\n            zeroclaw_api::channel::AttributedApprovalResponse::from_runtime(\n                ChannelApprovalResponse::Deny,\n                zeroclaw_api::channel::ApprovalSource::TimedOut,\n            )\n        }\n    };\n    Ok(attributed)\n}\n\nfn ensure_https(url: &str) -> anyhow::Result<()> {\n    if !url.starts_with(\"https://\") {\n        anyhow::bail!(\n            \"Refusing to transmit sensitive data over non-HTTPS URL: URL scheme must be https\"\n        );\n    }\n    Ok(())\n}\n\npub struct WhatsAppChannel {\n    access_token: String,\n    endpoint_id: String,\n    verify_token: String,\n    /// The alias key under `[channels.whatsapp.<alias>]` this handle is\n    /// bound to. Used to scope peer-group writes and resolver lookups.\n    alias: String,\n    /// Resolves inbound external peers from canonical state at message-time.\n    /// No cache (see AGENTS.md \"ABSOLUTE RULE — SINGLE SOURCE OF TRUTH\").\n    peer_resolver: Arc<dyn Fn() -> Vec<String> + Send + Sync>,\n    /// Per-channel proxy URL override.\n    proxy_url: Option<String>,","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-channels/src/whatsapp.rs#L142-L178","documentation":"A hard security guard in the WhatsApp channel: ensure_https requires the configured API base URL to start with https://, and every network call (post_message, send_interactive_buttons, send_interactive_list, health_check) passes through it. It refuses to transmit tokens and message payloads over plaintext HTTP.","triggerScenarios":"Configuring the WhatsApp API base_url with http:// (e.g., a local bridge at http://localhost:3000) or omitting/mistyping the scheme so it fails the https:// prefix check, then invoking send or health_check.","commonSituations":"Local development against a plain-HTTP WhatsApp bridge (WaAPI-style); port-forwards or tunnels without TLS; a missing scheme or leading whitespace in the URL.","solutions":["Change base_url to https:// — for local bridges, front them with a TLS-terminating reverse proxy (Caddy/nginx) or a TLS tunnel","Do not bypass the guard: it protects auth tokens and message content from network sniffing","Check the URL for a missing scheme, http typo, or stray whitespace before it"],"exampleFix":"# before\nbase_url = \"http://localhost:3000\"\n# after (TLS-terminating local proxy in front of the bridge)\nbase_url = \"https://localhost:8443\"","handlingStrategy":"validation","validationCode":"fn is_https_url(url: &str) -> bool {\n    url.trim_start().starts_with(\"https://\")\n}\nif !is_https_url(&cfg.base_url) {\n    return Err(anyhow::anyhow!(\"WhatsApp base_url must use https://\"));\n}","typeGuard":"fn is_https_url(url: &str) -> bool {\n    url.trim_start().starts_with(\"https://\")\n}","tryCatchPattern":"Do not catch-and-continue: this is a deliberate security refusal. Let it fail channel startup, fix the URL to https://, and put TLS in front of any local bridge.","preventionTips":["Run local WhatsApp bridges behind TLS from day one (Caddy/nginx or a TLS tunnel)","Validate the base_url scheme at config load time","Never bypass or downgrade this guard — it protects tokens and message payloads on the wire"],"tags":["whatsapp","https","security","url","config","tls"],"backgroundTag":"https-required-url","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}