{"record":{"id":"5b99680f91fec72c","repo":"siyuan-note/siyuan","slug":"remote-requires-https","errorCode":null,"errorMessage":"--remote requires HTTPS","messagePattern":"--remote requires HTTPS","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"app/electron/remoteKernel.js","lineNumber":25,"sourceCode":"    if (!arg) {\n        return;\n    }\n    return arg === name ? \"\" : arg.slice(prefix.length);\n};\n\nconst normalizeRemoteKernelOrigin = (value) => {\n    if (!value) {\n        throw new Error(\"--remote requires a URL\");\n    }\n    const url = new URL(value);\n    if (url.username || url.password) {\n        throw new Error(\"--remote does not accept credentials in the URL\");\n    }\n    if (url.pathname !== \"/\" || url.search || url.hash || value.includes(\"?\") || value.includes(\"#\")) {\n        throw new Error(\"--remote only accepts an origin without a path, query, or fragment\");\n    }\n    if (url.protocol !== \"https:\") {\n        throw new Error(\"--remote requires HTTPS\");\n    }\n    return url.origin;\n};\n\nconst insecureCertificateSwitchNames = Object.freeze([\n    \"allow-insecure-localhost\",\n    \"ignore-certificate-errors\",\n    \"ignore-certificate-errors-spki-list\",\n    \"ignore-ssl-errors\",\n    \"ignore-ssl-errors-with-hosts\",\n]);\nconst insecureCertificateSwitches = new Set(insecureCertificateSwitchNames);\nconst unsafeRemoteChromiumSwitchNames = Object.freeze([\n    ...insecureCertificateSwitchNames,\n    \"allow-running-insecure-content\",\n    \"disable-site-isolation-for-policy\",\n    \"disable-site-isolation-trials\",\n    \"disable-web-security\",","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/8641553a1f07374001902d3ce773285db1292b2d/app/electron/remoteKernel.js#L7-L43","documentation":"Remote kernel connections are restricted to HTTPS so that authentication tokens and workspace data are never sent in cleartext. normalizeRemoteKernelOrigin throws when the parsed URL's protocol is anything other than https: (e.g. http:).","triggerScenarios":"Passing --remote http://host:6806 (or any non-https scheme that new URL accepts and passes the earlier checks), so url.protocol !== \"https:\".","commonSituations":"Testing against a locally exposed kernel over plain HTTP; an old internal deployment that never used TLS; copying an http:// link from documentation; a misconfigured proxy redirecting to http.","solutions":["Serve the remote kernel behind a TLS-terminating reverse proxy (nginx/Caddy) and use https://","Obtain a valid certificate (e.g. via Let's Encrypt) for the remote host","For localhost testing, use a TLS-enabled tunnel (e.g. an HTTPS dev tunnel) or check whether an insecure-certificate allow-switch (see insecureCertificateSwitchNames) covers your case","Do not attempt to bypass by downgrading — the scheme check is intentional"],"exampleFix":"// before\n//   --remote \"http://myhost:6806\"\n// after\n//   --remote \"https://myhost:6806\"","handlingStrategy":"validation","validationCode":"const u = new URL(candidate);\nif (u.protocol !== \"https:\") {\n  throw new Error(\"--remote requires https:// — configure TLS on the remote host\");\n}","typeGuard":"const isHttpsOrigin = (v) => { try { return new URL(v).protocol === \"https:\"; } catch { return false; } };","tryCatchPattern":"try {\n  const origin = normalizeRemoteKernelOrigin(args.remote);\n} catch (e) {\n  if (e.message === \"--remote requires HTTPS\") {\n    // guide user to set up a TLS reverse proxy or an HTTPS tunnel\n  }\n}","preventionTips":["Always expose remote kernels behind HTTPS (nginx/Caddy/Let's Encrypt)","Use HTTPS tunnels for local testing instead of plain http://","Update documentation and bookmarks to https:// links"],"tags":["cli","https","security","url-validation","remote-kernel"],"backgroundTag":"invalid-url-format","analyzedSha":"8641553a1f07374001902d3ce773285db1292b2d","analyzedAt":"2026-09-11T16:08:28.414Z","contentChangedAt":"2026-09-11T16:08:28.414Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}