{"record":{"id":"6c9cc1db2fb1a577","repo":"microsoft/semantic-kernel","slug":"the-uri-scheme-addressuri-scheme-is-not-allowe","errorCode":null,"errorMessage":"The URI scheme '{addressUri.Scheme}' is not allowed for the '{operation.Name}' gRPC operation. Allowed schemes: {string.Join(\", \", this._allowedSchemes)}.","messagePattern":"The URI scheme '(.+?)' is not allowed for the '(.+?)' gRPC operation\\. Allowed schemes: (.+?)\\.","errorType":"exception","errorClass":"KernelException","httpStatus":null,"severity":"error","filePath":"dotnet/src/Functions/Functions.Grpc/GrpcOperationRunner.cs","lineNumber":185,"sourceCode":"        else\n        {\n            address = operation.Address;\n        }\n\n        if (string.IsNullOrEmpty(address))\n        {\n            throw new KernelException($\"No address provided for the '{operation.Name}' gRPC operation.\");\n        }\n\n        if (!Uri.TryCreate(address, UriKind.Absolute, out var addressUri))\n        {\n            throw new KernelException($\"The address '{address}' for the '{operation.Name}' gRPC operation is not a valid absolute URI.\");\n        }\n\n        // Validate scheme\n        if (!this._allowedSchemes.Contains(addressUri.Scheme, StringComparer.OrdinalIgnoreCase))\n        {\n            throw new KernelException($\"The URI scheme '{addressUri.Scheme}' is not allowed for the '{operation.Name}' gRPC operation. Allowed schemes: {string.Join(\", \", this._allowedSchemes)}.\");\n        }\n\n        // Validate against allowed addresses\n        if (this._allowedAddresses is { Count: > 0 })\n        {\n            bool isAllowed = false;\n            foreach (var allowedAddress in this._allowedAddresses)\n            {\n                string allowedUri = allowedAddress.AbsoluteUri;\n\n                if (addressUri.AbsoluteUri.StartsWith(allowedUri, StringComparison.OrdinalIgnoreCase))\n                {\n                    // If the allowed URI already ends at a boundary (e.g., trailing '/'),\n                    // or the full URIs match exactly, no further check is needed.\n                    // Otherwise, ensure the next character is a path boundary to prevent\n                    // prefix bypasses (e.g., allowed \"https://host/grpc\" should not match \"https://host/grpcevil\").\n                    int prefixLength = allowedUri.Length;\n                    if (prefixLength >= addressUri.AbsoluteUri.Length ||","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/dotnet/src/Functions/Functions.Grpc/GrpcOperationRunner.cs#L167-L203","documentation":"Thrown when the parsed URI's scheme is not in the configured `_allowedSchemes` allow-list (case-insensitive). This is a security control: it prevents the gRPC runner from connecting via unexpected schemes (e.g. file://, ftp://) that could be smuggled via a malicious address.","triggerScenarios":"Address uses a scheme not in the allowed set — commonly the allow-list contains only `https` (or `http`/`https`) and the address is `http://` in a production-locked config, or vice-versa.","commonSituations":"Local dev uses plain http but the runner was configured to allow only https; a misconfigured address override carrying the wrong scheme.","solutions":["Match the address scheme to the allowed set (prefer https).","If http is intentional and trusted, add it to AllowedSchemes in GrpcOperationRunnerOptions.","Double-check the address override URI scheme."],"exampleFix":"// before\n// address = http://service, allowedSchemes = [https]\n// after\naddress = \"https://service\";\n// or, only if http is explicitly trusted:\noptions.AllowedSchemes = new[] { \"http\", \"https\" };","handlingStrategy":"validation","validationCode":"var allowed = new[] { \"https\" };\nif (Uri.TryCreate(address, UriKind.Absolute, out var u) && !allowed.Contains(u.Scheme))\n    throw new InvalidOperationException($\"Scheme {u.Scheme} not allowed.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize on https in all environments when possible.","Explicitly allow http only for trusted local dev."],"tags":["grpc","network","security","configuration"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}