{"record":{"id":"652aa5f17667f788","repo":"larksuite/cli","slug":"invalid-proxy-address-q-scheme-must-be-http","errorCode":null,"errorMessage":"invalid proxy address %q: scheme must be http","messagePattern":"invalid proxy address %q: scheme must be http","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sidecar/protocol.go","lineNumber":171,"sourceCode":"\t\t\treturn errNotSameHost(addr)\n\t\t}\n\t\treturn nil\n\t}\n\n\tu, err := url.Parse(addr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: %w\", addr, err)\n\t}\n\tif u.User != nil {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: userinfo is not allowed\", addr)\n\t}\n\tif u.Scheme == \"https\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: use http:// — sidecar is \"+\n\t\t\t\"same-host only (loopback or virtual same-host bridge), so TLS adds \"+\n\t\t\t\"no security; cross-machine deployment is out of scope\", addr)\n\t}\n\tif u.Scheme != \"http\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: scheme must be http\", addr)\n\t}\n\tif u.Host == \"\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: missing host\", addr)\n\t}\n\tif u.Path != \"\" && u.Path != \"/\" {\n\t\treturn fmt.Errorf(\"invalid proxy address %q: path is not allowed\", addr)\n\t}\n\t// u.Hostname() strips the port and unwraps IPv6 brackets.\n\tif !isSameHost(u.Hostname()) {\n\t\treturn errNotSameHost(addr)\n\t}\n\treturn nil\n}\n\n// ProxyHost extracts the host:port from an AUTH_PROXY URL.\n// Input is expected to be an HTTP URL like \"http://127.0.0.1:16384\".\n// Returns the host:port portion for URL rewriting.\nfunc ProxyHost(authProxy string) string {","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/sidecar/protocol.go#L153-L189","documentation":"ValidateProxyAddr requires the proxy URL scheme to be exactly http (https is rejected separately with its own message). This error means the scheme was some other value — e.g. socks5, ws, ftp, or a typo like htp/HTTPs.","triggerScenarios":"Calling ValidateProxyAddr (via ResolveAccount / ResolveInterceptor / init) with values like \"socks5://127.0.0.1:1080\", \"ws://localhost:16384\", \"file:///tmp/proxy\", or \"HTTP://127.0.0.1:16384\" (url.Parse lowercases scheme? no — url.Parse preserves case in Scheme, so uppercase \"HTTP\" fails the == \"http\" comparison and lands here).","commonSituations":"Reusing a SOCKS proxy config; writing scheme in uppercase; pasting a websocket or non-http URL; typos like \"htp://\".","solutions":["Use lowercase http scheme: `export LARKSUITE_CLI_AUTH_PROXY=\"http://127.0.0.1:16384\"`.","Remove socks5/ws/file or other schemes — only http (or a bare host:port) is accepted.","Check the scheme is not uppercase; write it lowercase exactly as `http://`.","If you need a SOCKS proxy, that deployment is unsupported for the sidecar; run the sidecar on loopback http instead."],"exampleFix":"// before\nexport LARKSUITE_CLI_AUTH_PROXY=\"socks5://127.0.0.1:16384\"\n// after\nexport LARKSUITE_CLI_AUTH_PROXY=\"http://127.0.0.1:16384\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(addr)\nif err != nil {\n\treturn err\n}\nif u.Scheme != \"http\" {\n\treturn fmt.Errorf(\"scheme %q unsupported; use lowercase http://\", u.Scheme)\n}","typeGuard":"func isHTTPScheme(addr string) bool {\n\tu, err := url.Parse(addr)\n\treturn err == nil && u.Scheme == \"http\"\n}","tryCatchPattern":"if err := sidecar.ValidateProxyAddr(addr); err != nil {\n\tif strings.Contains(err.Error(), \"scheme must be http\") {\n\t\treturn fmt.Errorf(\"only http:// (or bare host:port) is accepted, got %q\", addr)\n\t}\n\treturn err\n}","preventionTips":["Write the scheme lowercase: http://.","Do not reuse socks5/ws/other proxy configs for LARKSUITE_CLI_AUTH_PROXY.","Prefer bare host:port (127.0.0.1:16384) if you do not need a scheme.","Validate the address at startup to fail before the first API call."],"tags":["configuration","proxy-address","url-scheme","sidecar"],"backgroundTag":"invalid-proxy-address","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}