{"record":{"id":"55835f5ee133af9f","repo":"larksuite/cli","slug":"invalid-proxy-address-q-use-http-sidecar-is","errorCode":null,"errorMessage":"invalid proxy address %q: use http:// — sidecar is same-host only (loopback or virtual same-host bridge), so TLS adds no security; cross-machine deployment is out of scope","messagePattern":"invalid proxy address %q: use http:// — sidecar is same-host only \\(loopback or virtual same-host bridge\\), so TLS adds no security; cross-machine deployment is out of scope","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sidecar/protocol.go","lineNumber":166,"sourceCode":"\t\t}\n\t\tif host == \"\" || port == \"\" {\n\t\t\treturn fmt.Errorf(\"invalid proxy address %q: host and port must not be empty\", addr)\n\t\t}\n\t\tif !isSameHost(host) {\n\t\t\treturn errNotSameHost(addr)\n\t\t}\n\t\treturn nil\n\t}\n\n\tu, err := url.Parse(addr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: %w\", addr, err)\n\t}\n\tif u.User != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: userinfo is not allowed\", addr)\n\t}\n\tif u.Scheme == \"https\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: use http:// — sidecar is \"+\n\t\t\t\"same-host only (loopback or virtual same-host bridge), so TLS adds \"+\n\t\t\t\"no security; cross-machine deployment is out of scope\", addr)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: scheme must be http\", addr)\n\t}\n\tif u.Host == \"\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: missing host\", addr)\n\t}\n\tif u.Path != \"\" && u.Path != \"/\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: path is not allowed\", addr)\n\t}\n\t// u.Hostname() strips the port and unwraps IPv6 brackets.\n\tif !isSameHost(u.Hostname()) {\n\t\treturn errNotSameHost(addr)\n\t}\n\treturn nil\n}","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/sidecar/protocol.go#L148-L184","documentation":"ValidateProxyAddr rejects https:// proxy URLs. The sidecar is a same-host-only pattern: traffic goes over loopback or a virtual same-host bridge, so TLS adds no security, and cross-machine deployment (where TLS would matter) is explicitly out of scope.","triggerScenarios":"Setting LARKSUITE_CLI_AUTH_PROXY to an https URL such as \"https://127.0.0.1:16384\" or \"https://localhost:16384\" — typically when the sidecar was put behind TLS or the value was copied from an external proxy config.","commonSituations":"Configuring the sidecar the same way as a remote HTTPS proxy; a reverse proxy (nginx/caddy) exposing the sidecar over https; habitually writing https for all local services; docs from another product.","solutions":["Change the scheme to http://: `export LARKSUITE_CLI_AUTH_PROXY=\"http://127.0.0.1:16384\"`.","Connect the CLI directly to the sidecar's plaintext loopback listener (DefaultListenAddr 127.0.0.1:16384) instead of through a TLS-terminating reverse proxy.","If you were adding TLS because the sidecar seemed remotely reachable, restructure to the supported same-host deployment — TLS is intentionally not the mechanism here.","Keep any external-facing gateway separate; the CLI must point at the same-host http endpoint."],"exampleFix":"// before\nexport LARKSUITE_CLI_AUTH_PROXY=\"https://127.0.0.1:16384\"\n// after\nexport LARKSUITE_CLI_AUTH_PROXY=\"http://127.0.0.1:16384\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(addr)\nif err == nil && u.Scheme == \"https\" {\n\treturn errors.New(\"sidecar proxy must be http:// (same-host loopback); https:// is rejected\")\n}","typeGuard":"func isPlainHTTP(addr string) bool {\n\tu, err := url.Parse(addr)\n\treturn err == nil && u.Scheme == \"http\"\n}","tryCatchPattern":"if err := sidecar.ValidateProxyAddr(addr); err != nil {\n\tif strings.Contains(err.Error(), \"use http://\") {\n\t\treturn fmt.Errorf(\"switch LARKSUITE_CLI_AUTH_PROXY to http:// — TLS is not needed same-host: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Write http://, never https://, for the sidecar address.","Point the CLI at the sidecar's plaintext loopback listener directly, not a TLS reverse proxy.","If you think you need TLS, the deployment is cross-machine and unsupported — move the sidecar onto the sandbox host.","Document the http-only constraint in team config templates."],"tags":["configuration","tls","proxy-address","sidecar","security"],"backgroundTag":"https-scheme-rejected","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}