{"record":{"id":"4ea4f511a4b7f44a","repo":"pola-rs/polars","slug":"a-non-https-workspace-url-was-given-workspace-ur","errorCode":null,"errorMessage":"a non-HTTPS workspace_url was given ({workspace_url}). To allow non-HTTPS URLs, pass require_https=False.","messagePattern":"a non-HTTPS workspace_url was given \\((.+?)\\)\\. To allow non-HTTPS URLs, pass require_https=False\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"py-polars/src/polars/catalog/unity/client.py","lineNumber":91,"sourceCode":"            URL of the workspace, or alternatively the URL of the Unity catalog\n            API endpoint.\n        bearer_token\n            Bearer token to authenticate with. This can also be set to:\n\n            * \"auto\": Automatically retrieve bearer tokens from the environment.\n            * \"databricks-sdk\": Use the Databricks SDK to retrieve and use the\n              bearer token from the environment.\n        require_https\n            Require the `workspace_url` to use HTTPS.\n        \"\"\"\n        issue_unstable_warning(\"`Catalog` functionality is considered unstable.\")\n\n        if require_https and not workspace_url.startswith(\"https://\"):\n            msg = (\n                f\"a non-HTTPS workspace_url was given ({workspace_url}). To \"\n                \"allow non-HTTPS URLs, pass require_https=False.\"\n            )\n            raise ValueError(msg)\n\n        if bearer_token == \"databricks-sdk\" or (\n            bearer_token == \"auto\"\n            # For security, in \"auto\" mode, only retrieve/use the token if:\n            # * We are running inside a Databricks environment\n            # * The `workspace_url` is pointing to Databricks and uses HTTPS\n            and \"DATABRICKS_RUNTIME_VERSION\" in os.environ\n            and workspace_url.startswith(\"https://\")\n            and (\n                workspace_url.removeprefix(\"https://\")\n                .split(\"/\", 1)[0]\n                .endswith(\".cloud.databricks.com\")\n            )\n        ):\n            bearer_token = self._get_databricks_token()\n\n        if bearer_token == \"auto\":\n            bearer_token = None","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/pola-rs/polars/blob/df599052daf96e7a9cc30a3b0c6bd25d6947e3c0/py-polars/src/polars/catalog/unity/client.py#L73-L109","documentation":"ValueError from the Unity Catalog client constructor (py-polars/src/polars/catalog/unity/client.py:82-92). pl.catalog.unity.Catalog requires workspace_url to start with 'https://' when require_https=True (the default). Because the bearer token is sent to this host, a plain-HTTP workspace URL is treated as a credential-leak risk and rejected unless you explicitly opt out with require_https=False. In bearer_token='auto' mode the SDK path additionally only engages for HTTPS *.cloud.databricks.com URLs inside Databricks runtimes.","triggerScenarios":"Catalog(workspace_url='http://adb-123...azuredatabricks.net', bearer_token=...) with default require_https=True; internal/on-prem gateways with http endpoints; URLs missing the scheme or using hostnames only.","commonSituations":"Corporate proxies that rewrite URLs to http; test environments against a local mock Databricks/Unity endpoint; typos in the scheme ('http://', 'adb-...' without scheme).","solutions":["Use the HTTPS workspace URL, e.g. https://adb-xxxx.azuredatabricks.net","Only for trusted internal networks, pass require_https=False explicitly","Check for a scheme typo or a proxy stripping https before the value reaches your config"],"exampleFix":"# before\ncatalog = Catalog(workspace_url='http://adb-123.azuredatabricks.net', bearer_token=tok)\n\n# after\ncatalog = Catalog(workspace_url='https://adb-123.azuredatabricks.net', bearer_token=tok)","handlingStrategy":"validation","validationCode":"def workspace_url_ok(url: str, *, require_https: bool = True) -> bool:\n    return (not require_https) or url.startswith('https://')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Source workspace_url from a secret/config store that stores the full https:// URL","Reject http:// at config load time so the failure is caught before credential setup","Only pass require_https=False for explicitly trusted internal endpoints"],"tags":["polars","unity-catalog","databricks","security","https","valueerror"],"backgroundTag":null,"analyzedSha":"df599052daf96e7a9cc30a3b0c6bd25d6947e3c0","analyzedAt":"2026-08-16T12:10:03.978Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}