{"record":{"id":"73725231a2ad16be","repo":"apache/flink","slug":"artifact-fetching-from-raw-http-endpoints-are-disa","errorCode":null,"errorMessage":"Artifact fetching from raw HTTP endpoints are disabled. Set the '%s' property to override.","messagePattern":"Artifact fetching from raw HTTP endpoints are disabled\\. Set the '(.+?)' property to override\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"flink-clients/src/main/java/org/apache/flink/client/program/artifact/ArtifactFetchManager.java","lineNumber":160,"sourceCode":"    }\n\n    private File fetchArtifact(String uri) throws Exception {\n        URI resolvedUri = PackagedProgramUtils.resolveURI(uri);\n        File targetFile = new File(baseDir, FilenameUtils.getName(resolvedUri.getPath()));\n        if (targetFile.exists()) {\n            // Already fetched user artifacts are kept.\n            return targetFile;\n        }\n\n        return getFetcher(resolvedUri).fetch(uri, conf, baseDir);\n    }\n\n    private boolean isRawHttp(String uriScheme) {\n        if (\"http\".equals(uriScheme)) {\n            if (conf.get(ArtifactFetchOptions.RAW_HTTP_ENABLED)) {\n                return true;\n            }\n            throw new IllegalArgumentException(\n                    String.format(\n                            \"Artifact fetching from raw HTTP endpoints are disabled. Set the '%s' property to override.\",\n                            ArtifactFetchOptions.RAW_HTTP_ENABLED.key()));\n        }\n\n        return false;\n    }\n\n    /** Artifact fetch result with all fetched artifact(s). */\n    public static class Result {\n\n        private final File jobJar;\n        private final List<File> artifacts;\n\n        private Result(@Nullable File jobJar, @Nullable List<File> additionalJars) {\n            this.jobJar = jobJar;\n            this.artifacts = additionalJars == null ? Collections.emptyList() : additionalJars;\n        }","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-clients/src/main/java/org/apache/flink/client/program/artifact/ArtifactFetchManager.java#L142-L178","documentation":"Thrown when an artifact URI uses the 'http' scheme but raw HTTP fetching is disabled by default (ArtifactFetchOptions.RAW_HTTP_ENABLED is false). Flink only allows https by default for security; plain http must be explicitly opted in. The message names the configuration key needed to override.","triggerScenarios":"Submitting a job with an artifact URI starting with 'http://' (not https) while ArtifactFetchOptions.RAW_HTTP_ENABLED is not set to true. The check happens in isRawHttp when selecting the fetcher for the URI scheme.","commonSituations":"Internal HTTP artifact registry without TLS, or a local development environment using plain HTTP. Production setups typically use HTTPS and never hit this.","solutions":["Use https:// URIs for artifacts if possible (recommended).","If plain HTTP is required (e.g., internal registry), set ArtifactFetchOptions.RAW_HTTP_ENABLED=true in the cluster/job configuration.","For local files, use the 'local' scheme or a file path instead of http.","For distributed filesystems, use the appropriate scheme (hdfs://, s3://, etc.)."],"exampleFix":"# before: plain http artifact URI\nflink run --python http://my-registry/job.py\n\n# after: enable raw http or use https\n# option 1: enable raw http\nconfig.set(\"artifact-fetch.raw-http-enabled\", \"true\")\n# option 2: use https\nflink run --python https://my-registry/job.py","handlingStrategy":"validation","validationCode":"URI uri = URI.create(artifactUri);\nif (\"http\".equalsIgnoreCase(uri.getScheme())\n        && !conf.get(ArtifactFetchOptions.RAW_HTTP_ENABLED)) {\n    throw new IllegalArgumentException(\n        \"Raw HTTP artifacts disabled. Use https or set \"\n            + ArtifactFetchOptions.RAW_HTTP_ENABLED.key());\n}","typeGuard":null,"tryCatchPattern":"try {\n    fetchManager.fetchArtifacts(uris);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"raw HTTP endpoints are disabled\")) {\n        // switch to https or enable raw http\n    }\n    throw e;\n}","preventionTips":["Prefer https:// for all artifact URIs.","If plain HTTP is unavoidable, explicitly set ArtifactFetchOptions.RAW_HTTP_ENABLED=true.","Use local file paths or filesystem schemes (hdfs, s3) where appropriate."],"tags":["artifact-fetch","security","http","configuration","scheme"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}