{"record":{"id":"4519b35833ae3a80","repo":"k3s-io/k3s","slug":"only-https-urls-are-supported-invalid-scheme","errorCode":null,"errorMessage":"only https:// URLs are supported, invalid scheme: ","messagePattern":"only https:// URLs are supported, invalid scheme: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/clientaccess/token.go","lineNumber":371,"sourceCode":"\t\treturn nil, err\n\t}\n\tp.Scheme = u.Scheme\n\tp.Host = u.Host\n\tclient := GetHTTPClient(i.CACerts, i.CertFile, i.KeyFile, options...)\n\treturn post(p.String(), body, client, i.Username, i.Password, i.Token(), options...)\n}\n\n// setServer sets the BaseURL and CACerts fields of the Info by connecting to the server\n// and storing the CA bundle. If CACerts has already been set via ValidationOption,\n// retrieval is skipped.\nfunc (i *Info) setServer(server string) error {\n\turl, err := url.Parse(server)\n\tif err != nil {\n\t\treturn errors.WithMessagef(err, \"Invalid server url, failed to parse: %s\", server)\n\t}\n\n\tif url.Scheme != \"https\" {\n\t\treturn errors.New(\"only https:// URLs are supported, invalid scheme: \" + server)\n\t}\n\n\tfor strings.HasSuffix(url.Path, \"/\") {\n\t\turl.Path = url.Path[:len(url.Path)-1]\n\t}\n\n\tif len(i.CACerts) == 0 {\n\t\tcacerts, err := getCACerts(*url)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ti.CACerts = cacerts\n\t}\n\n\ti.BaseURL = url.String()\n\treturn nil\n}\n","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/clientaccess/token.go#L353-L389","documentation":"Info.setServer parses the server URL supplied to clientaccess APIs and only accepts the https scheme, because the k3s supervisor/API endpoint is TLS-only. Any http:// (or other scheme) URL is rejected before CA bundle retrieval begins.","triggerScenarios":"`k3s agent --server http://10.0.0.10:6443`, or Go code calling clientaccess.NewAccessInfo/ParseAndValidateToken with an http:// URL; also URLs missing their scheme entirely after parsing yield an empty scheme.","commonSituations":"Load balancers or reverse proxies terminating TLS in front of k3s with plain-http backends assumed; operators typing http out of habit; environment-provided URLs (K3S_URL) without a scheme.","solutions":["Use the https scheme: `--server https://10.0.0.10:6443`","If a proxy terminates TLS, point k3s at the https frontend or use TCP passthrough to the k3s port","In Go callers, scheme-check the URL before handing it to clientaccess"],"exampleFix":"# before\nK3S_URL=http://10.0.0.10:6443 k3s agent\n\n# after\nK3S_URL=https://10.0.0.10:6443 k3s agent","handlingStrategy":"validation","validationCode":"u, err := url.Parse(serverURL)\nif err != nil {\n    return fmt.Errorf(\"unparseable server url: %w\", err)\n}\nif u.Scheme != \"https\" {\n    return fmt.Errorf(\"server url must use https, got %q\", u.Scheme)\n}\ninfo, err := clientaccess.ParseAndValidateToken(u.String(), token)","typeGuard":"func isHTTPSServerURL(raw string) bool {\n    u, err := url.Parse(raw)\n    return err == nil && u.Scheme == \"https\" && u.Host != \"\"\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"only https:// URLs are supported\") {\n    return fmt.Errorf(\"set K3S_URL/--server to https://; k3s does not serve plain http\")\n}","preventionTips":["Standardize https:// in all node/cluster URL variables in tooling","Configure LBs for TLS passthrough or TCP mode in front of k3s","Lint unit files and config.yaml for http:// server URLs"],"tags":["token","url","tls","networking","clientaccess"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}