{"record":{"id":"8b4f642c5ef02643","repo":"GoogleContainerTools/jib","slug":"insecure-http-connection-not-allowed-url","errorCode":null,"errorMessage":"insecure HTTP connection not allowed: + url","messagePattern":"insecure HTTP connection not allowed: \\+ url","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java","lineNumber":257,"sourceCode":"  public Response put(URL url, Request request) throws IOException {\n    return call(HttpMethods.PUT, url, request);\n  }\n\n  /**\n   * Sends the request.\n   *\n   * @param httpMethod the HTTP request method\n   * @param url endpoint URL\n   * @param request the request to send\n   * @return the response to the sent request\n   * @throws IOException if building the HTTP request fails.\n   */\n  public Response call(String httpMethod, URL url, Request request) throws IOException {\n    if (!isHttpsProtocol(url)) {\n      if (enableHttpAndInsecureFailover) { // HTTP requested. We only care if HTTP is enabled.\n        return call(httpMethod, url, request, getHttpTransport(true), true);\n      }\n      throw new SSLException(\"insecure HTTP connection not allowed: \" + url);\n    }\n\n    Optional<Response> fastPathResponse = followFailoverHistory(httpMethod, url, request);\n    if (fastPathResponse.isPresent()) {\n      return fastPathResponse.get();\n    }\n\n    try {\n      return call(httpMethod, url, request, getHttpTransport(true), !enableHttpAndInsecureFailover);\n\n    } catch (SSLException ex) {\n      if (!enableHttpAndInsecureFailover) {\n        throw ex;\n      }\n\n      try {\n        logInsecureHttpsFailover(url);\n        Response response = call(httpMethod, url, request, getHttpTransport(false), false);","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java#L239-L275","documentation":"FailoverHttpClient.call() rejects plain-HTTP (non-HTTPS) registry URLs unless HTTP and insecure failover were explicitly enabled at construction. This SSLException names the offending URL. Jib requires HTTPS by default for registry communication security.","triggerScenarios":"Calling get/post/put/call with an http:// registry URL while the client was built without allowInsecureRegistries / HTTP failover enabled.","commonSituations":"Pointing jib at a local or offline registry (localhost:5000, corporate mirror) over http:// without enabling insecure access; misconfigured registry base URL missing the https scheme.","solutions":["Use an https:// registry URL","Enable insecure failover: configure allowInsecureRegistries (Jib's --allow-insecure-registries / Containerizer.setAllowInsecureRegistries(true))","Set up TLS on your registry and trust its certificate","Fix the registry URL if 'http://' was a typo"],"exampleFix":"// before\nContainerizer.to(RegistryImage.named(\"http://localhost:5000/myapp\"));\n// after\nContainerizer.to(\n    RegistryImage.named(\"localhost:5000/myapp\")\n        .setCredentialRetriever(...))\n  .setAllowInsecureRegistries(true);","handlingStrategy":"validation","validationCode":"URL u = new URL(registryUrl);\nif (!\"https\".equals(u.getProtocol()) && !allowInsecure) throw new IllegalArgumentException(\"Insecure registry requires allowInsecureRegistries: \" + u);","typeGuard":null,"tryCatchPattern":"try { jibStep(); } catch (SSLException e) { if (e.getMessage().startsWith(\"insecure HTTP connection not allowed\")) { failBuild(\"Enable allowInsecureRegistries or use https://\"); } throw e; }","preventionTips":["Always use https:// registry endpoints in production","For local dev registries (localhost:5000), enable allowInsecureRegistries or add TLS to the registry","Audit build scripts for http:// registry URLs"],"tags":["network","https","ssl-exception","registry","insecure-connection"],"backgroundTag":"http-request-failed","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}