{"record":{"id":"4547635c8e2f423b","repo":"different-ai/openwork","slug":"den-api-public-url-must-use-https-outside-developm","errorCode":null,"errorMessage":"DEN_API_PUBLIC_URL must use HTTPS outside development and localhost.","messagePattern":"DEN_API_PUBLIC_URL must use HTTPS outside development and localhost\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-api/src/request-url.ts","lineNumber":107,"sourceCode":"): string | undefined {\n  const configured = value?.trim()\n  if (!configured) return undefined\n\n  let url: URL\n  try {\n    url = new URL(configured)\n  } catch {\n    throw new Error(\"DEN_API_PUBLIC_URL must be an absolute http or https URL.\")\n  }\n\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new Error(\"DEN_API_PUBLIC_URL must be an absolute http or https URL.\")\n  }\n  if (url.username || url.password || url.search || url.hash) {\n    throw new Error(\"DEN_API_PUBLIC_URL cannot contain credentials, a query string, or a fragment.\")\n  }\n  if (url.protocol !== \"https:\" && !options.allowInsecureHttp && !isLocalPublicApiHost(url.hostname)) {\n    throw new Error(\"DEN_API_PUBLIC_URL must use HTTPS outside development and localhost.\")\n  }\n\n  const pathname = url.pathname.replace(/\\/+$/, \"\")\n  return `${url.origin}${pathname === \"/\" ? \"\" : pathname}`\n}\n","sourceCodeStart":89,"sourceCodeEnd":113,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/request-url.ts#L89-L113","documentation":"This error enforces TLS in production: if DEN_API_PUBLIC_URL uses http:// and the environment neither sets options.allowInsecureHttp nor has a localhost-style hostname (isLocalPublicApiHost), the public base URL is rejected. It prevents serving public API links over plaintext outside development.","triggerScenarios":"apiPublicUrl -> normalizeConfiguredPublicApiBaseUrl with DEN_API_PUBLIC_URL=http://api.example.com on a production deployment where allowInsecureHttp is false and the hostname is not localhost/127.0.0.1/etc.","commonSituations":"Deploying behind a TLS-terminating proxy but configuring the internal http:// origin as the public URL; forgetting to switch from a local http URL when promoting staging config to production; misclassifying a public hostname as local.","solutions":["Set DEN_API_PUBLIC_URL to https://api.example.com (terminate TLS at your proxy/load balancer).","If this is genuinely a dev environment, enable the allowInsecureHttp option (or the corresponding dev env flag) for this deployment.","Use a localhost hostname (localhost, 127.0.0.1) if the URL really is local-only and exempt from the HTTPS rule.","Audit the deploy config so production always inherits an https:// public URL."],"exampleFix":"// before\nDEN_API_PUBLIC_URL=http://api.example.com\n// after\nDEN_API_PUBLIC_URL=https://api.example.com","handlingStrategy":"validation","validationCode":"const u = new URL(process.env.DEN_API_PUBLIC_URL ?? \"\")\nif (u.protocol === \"http:\" && !isLocalPublicApiHost(u.hostname)) {\n  throw new Error(\"DEN_API_PUBLIC_URL must use HTTPS outside development and localhost\")\n}","typeGuard":"function isProductionSafePublicUrl(value: string | undefined): value is string {\n  try {\n    const u = new URL(value ?? \"\")\n    return u.protocol === \"https:\" || (u.protocol === \"http:\" && isLocalPublicApiHost(u.hostname))\n  } catch { return false }\n}","tryCatchPattern":"try {\n  const baseUrl = apiPublicUrl(env)\n} catch (e) {\n  if (e.message.includes(\"must use HTTPS\")) {\n    console.error(\"Configure a TLS endpoint (e.g. via your ingress/proxy) and set DEN_API_PUBLIC_URL to https://...\")\n    process.exit(1)\n  }\n  throw e\n}","preventionTips":["Terminate TLS at your proxy/load balancer and expose the https origin as DEN_API_PUBLIC_URL","Only use http:// with localhost hostnames in dev, where the insecure-HTTP exemption applies","Set NODE_ENV/deployment flags consistently so allowInsecureHttp never reaches production","Run an env lint in CI that fails when production config contains an http:// public URL"],"tags":["configuration","env","tls","security","url"],"backgroundTag":"https-required","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}