{"record":{"id":"6c7c07a5fdd38fa6","repo":"Kong/insomnia","slug":"failed-to-fetch-href-only-https-urls-to-publ","errorCode":null,"errorMessage":"Failed to fetch \"${href}\". Only https URLs to public hosts are allowed.","messagePattern":"Failed to fetch \"(.+?)\"\\. Only https URLs to public hosts are allowed\\.","errorType":"http","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/insomnia/src/main/lint-process.mjs","lineNumber":79,"sourceCode":"  return Boolean(url.hostname) && !isPrivateOrLoopbackHost(url.hostname.toLowerCase());\n}\n\n// Note: This is duplicated in inso's lint-specification.ts. Remember to mirror changes there as well.\nasync function assertResolvesToPublicHost(hostname) {\n  const records = await dns.lookup(hostname, { all: true });\n  for (const { address } of records) {\n    if (isPrivateOrLoopbackHost(address)) {\n      throw new Error(`Failed to resolve host. \"${hostname}\" resolves to a private or loopback address.`);\n    }\n  }\n}\n\n// Note: This is duplicated in inso's lint-specification.ts. Remember to mirror changes there as well.\nconst safeHttpResolver = {\n  async resolve(ref) {\n    const href = ref.href();\n    if (!isSafeRefUrl(href)) {\n      throw new Error(`Failed to fetch \"${href}\". Only https URLs to public hosts are allowed.`);\n    }\n    await assertResolvesToPublicHost(new URL(href).hostname.toLowerCase());\n    const response = await fetch(href, { redirect: 'error', signal: AbortSignal.timeout(10_000) });\n    if (!response.ok) {\n      throw new Error(`Failed to fetch \"${href}\": ${response.status} ${response.statusText}`);\n    }\n    return response.text();\n  },\n};\n\n// Note: This is duplicated in inso's lint-specification.ts. Remember to mirror changes there as well.\nconst safeRefResolver = new Resolver({\n  resolvers: {\n    http: safeHttpResolver,\n    https: safeHttpResolver,\n  },\n});\n","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/Kong/insomnia/blob/d9bb2b0142600f21309832daea3317942d285984/packages/insomnia/src/main/lint-process.mjs#L61-L97","documentation":"Error \"Failed to fetch \"${href}\". Only https URLs to public hosts are allowed.\" thrown in Kong/insomnia.","triggerScenarios":"Thrown at packages/insomnia/src/main/lint-process.mjs:79 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9bb2b0142600f21309832daea3317942d285984","analyzedAt":"2026-08-26T18:04:05.187Z","schemaVersion":2},"datasetVersion":"2026-08-26T21:11:00.512Z"}