{"record":{"id":"69a543c8e940c6c7","repo":"gchq/CyberChef","slug":"e-tostring-n-nthis-error-could-be-caused-by-o","errorCode":null,"errorMessage":"${e.toString()}\\n\\nThis error could be caused by one of the following:\\n - An invalid URL\\n - Making a request to an insecure resource (HTTP) from a secure source (HTTPS)\\n - Making a cross-origin request to a server which does not support CORS\\n","messagePattern":"(.+?)\\\\n\\\\nThis error could be caused by one of the following:\\\\n - An invalid URL\\\\n - Making a request to an insecure resource \\(HTTP\\) from a secure source \\(HTTPS\\)\\\\n - Making a cross-origin request to a server which does not support CORS\\\\n","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"warning","filePath":"src/core/operations/HTTPRequest.mjs","lineNumber":125,"sourceCode":"            .then(r => {\n                if (r.status === 0 && r.type === \"opaque\") {\n                    throw new OperationError(\"Error: Null response. Try setting the connection mode to CORS.\");\n                }\n\n                if (showResponseMetadata) {\n                    let headers = \"\";\n                    for (const pair of r.headers.entries()) {\n                        headers += \"    \" + pair[0] + \": \" + pair[1] + \"\\n\";\n                    }\n                    return r.text().then(b => {\n                        return \"####\\n  Status: \" + r.status + \" \" + r.statusText +\n                            \"\\n  Exposed headers:\\n\" + headers + \"####\\n\\n\" + b;\n                    });\n                }\n                return r.text();\n            })\n            .catch(e => {\n                throw new OperationError(e.toString() +\n                    \"\\n\\nThis error could be caused by one of the following:\\n\" +\n                    \" - An invalid URL\\n\" +\n                    \" - Making a request to an insecure resource (HTTP) from a secure source (HTTPS)\\n\" +\n                    \" - Making a cross-origin request to a server which does not support CORS\\n\");\n            });\n    }\n\n}\n\n\n/**\n * Lookup table for HTTP modes\n *\n * @private\n */\nconst modeLookup = {\n    \"Cross-Origin Resource Sharing\": \"cors\",\n    \"No CORS (limited to HEAD, GET or POST)\": \"no-cors\",","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/HTTPRequest.mjs#L107-L143","documentation":"Catch-all OperationError wrapping any exception from the underlying fetch() call. The promise .catch handler appends a hint listing the three most common fetch failure causes: invalid URL, mixed-content (HTTP target from HTTPS origin), and missing CORS support. The original error's toString() is preserved as the prefix.","triggerScenarios":"Malformed URL (fetch TypeError 'Failed to fetch' / 'Invalid URL'); HTTPS CyberChef page calling an HTTP endpoint (mixed content blocked); cross-origin request to a server without Access-Control-Allow-Origin; DNS failure; network offline; self-signed cert rejected.","commonSituations":"Typo in URL; using http:// from a hosted https CyberChef; hitting an internal/airgapped-only endpoint from the public instance; corporate proxy stripping CORS headers; certificate warnings on the target.","solutions":["Read the preserved original error prefix to identify which of the three hint causes applies.","Switch the target to https:// if CyberChef is served over https (avoid mixed content).","Set Connection mode to CORS and confirm the server sends Access-Control-Allow-Origin.","Validate the URL with `new URL(url)` before invoking.","Test the same URL with curl to confirm the server is reachable and CORS-enabled."],"exampleFix":"// before\nrun(\"http://example.com/api\", [\"GET\", \"http://example.com/api\", \"\", \"CORS\", false]);\n// after - use https and a CORS-enabled endpoint\nrun(\"https://api.example.com/data\", [\"GET\", \"https://api.example.com/data\", \"\", \"Cross-Origin Resource Sharing\", false]);","handlingStrategy":"try-catch","validationCode":"function assertFetchableUrl(raw) {\n  const u = new URL(raw);              // throws on invalid URL\n  if (globalThis.location && globalThis.location.protocol === 'https:' && u.protocol === 'http:') {\n    throw new Error('Mixed content: https page cannot fetch http target');\n  }\n  return u;\n}","typeGuard":"function isLikelyFetchableUrl(raw) {\n  try { assertFetchableUrl(raw); return true; } catch { return false; }\n}","tryCatchPattern":"try {\n  result = await httpReq.run(url, args);\n} catch (e) {\n  if (e instanceof OperationError) {\n    // inspect the preserved original-error prefix for the real cause\n    if (/Failed to fetch/i.test(e.message)) handleNetworkOrCors();\n    else if (/invalid url/i.test(e.message)) fixUrl();\n    else handleMixedContent();\n  } else throw e;\n}","preventionTips":["Validate with `new URL(url)` before invoking.","Prefer https targets when CyberChef is served over https.","Test the URL with curl first to separate network/CORS from URL issues.","Confirm Access-Control-Allow-Origin on cross-origin targets."],"tags":["http","fetch","cors","mixed-content","url-validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}