{"record":{"id":"93a0d38584c7ed69","repo":"can1357/oh-my-pi","slug":"gitlab-redirect-uri-must-use-http-or-https","errorCode":null,"errorMessage":"GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}","messagePattern":"GITLAB_REDIRECT_URI must use http:// or https://, got: (.+?)","errorType":"exception","errorClass":"AIError.OAuthError","httpStatus":null,"severity":"error","filePath":"packages/ai/src/registry/oauth/gitlab-duo.ts","lineNumber":69,"sourceCode":"\tif (!raw) {\n\t\treturn {\n\t\t\tpreferredPort: DEFAULT_CALLBACK_PORT,\n\t\t\tcallbackPath: DEFAULT_CALLBACK_PATH,\n\t\t\tcallbackHostname: DEFAULT_CALLBACK_HOSTNAME,\n\t\t};\n\t}\n\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(raw);\n\t} catch {\n\t\tthrow new AIError.OAuthError(`Invalid GITLAB_REDIRECT_URI: ${raw}`, {\n\t\t\tkind: \"configuration\",\n\t\t\tprovider: \"gitlab-duo\",\n\t\t});\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\tthrow new AIError.OAuthError(`GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}`, {\n\t\t\tkind: \"configuration\",\n\t\t\tprovider: \"gitlab-duo\",\n\t\t});\n\t}\n\n\tconst isLoopback = parsed.hostname === \"localhost\" || parsed.hostname === \"127.0.0.1\" || parsed.hostname === \"[::1]\";\n\tif (isLoopback && parsed.protocol !== \"http:\") {\n\t\tthrow new AIError.OAuthError(`GITLAB_REDIRECT_URI loopback callbacks must use http://, got: ${raw}`, {\n\t\t\tkind: \"configuration\",\n\t\t\tprovider: \"gitlab-duo\",\n\t\t});\n\t}\n\n\tconst port = parsed.port ? Number.parseInt(parsed.port, 10) : parsed.protocol === \"https:\" ? 443 : 80;\n\n\treturn {\n\t\tpreferredPort: isLoopback ? port : 0,\n\t\tcallbackPath: parsed.pathname || DEFAULT_CALLBACK_PATH,","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/ai/src/registry/oauth/gitlab-duo.ts#L51-L87","documentation":"After GITLAB_REDIRECT_URI parses as a URL, resolveCallbackOptions requires the protocol to be http: or https:. Any other scheme (ftp:, ws:, app:, vscode:, etc.) throws this configuration OAuthError. The local callback server can only speak plain HTTP(S), so other schemes cannot receive the OAuth code.","triggerScenarios":"GITLAB_REDIRECT_URI is a valid URL whose scheme is neither http: nor https: — e.g. 'https//...' typos producing odd schemes, 'ftp://localhost/callback', 'vscode://gitlab.gitlab-workflow/authentication', or 'wss://...'.","commonSituations":"Copying the vscode:// redirect URI used by the Duo Workflow flow into GITLAB_REDIRECT_URI; using custom URI schemes intended for desktop apps; typos where the scheme is mangled so URL parsing succeeds with an unexpected protocol.","solutions":["Change GITLAB_REDIRECT_URI to start with http:// (recommended for loopback) or https://.","Use http://localhost:<port>/callback and register that exact URI on your GitLab OAuth application.","Unset GITLAB_REDIRECT_URI to use the built-in default http://localhost:8080/callback.","Use GITLAB_TOKEN (Personal Access Token) to bypass the browser OAuth flow entirely."],"exampleFix":"// before (.env)\nGITLAB_REDIRECT_URI=vscode://gitlab.gitlab-workflow/authentication\n\n// after (.env)\nGITLAB_REDIRECT_URI=http://localhost:8080/callback","handlingStrategy":"validation","validationCode":"const raw = process.env.GITLAB_REDIRECT_URI?.trim();\nif (raw) {\n  const u = new URL(raw);\n  if (u.protocol !== \"http:\" && u.protocol !== \"https:\") {\n    throw new Error(`GITLAB_REDIRECT_URI must start with http:// or https://, got: ${raw}`);\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  await loginGitLabDuo(callbacks);\n} catch (err) {\n  if (err?.kind === \"configuration\" && String(err.message).includes(\"must use http:// or https://\")) {\n    process.env.GITLAB_REDIRECT_URI = \"http://localhost:8080/callback\";\n    await loginGitLabDuo(callbacks);\n  } else {\n    throw err;\n  }\n}","preventionTips":["Never put custom schemes (vscode://, app://) in GITLAB_REDIRECT_URI — the local callback server is HTTP only.","Register http://localhost:<port>/callback on your GitLab OAuth application and use exactly that.","Use vscode:// redirect flows only through the dedicated Duo Workflow login, not GITLAB_REDIRECT_URI."],"tags":["oauth","gitlab","configuration","env-var"],"backgroundTag":"invalid-redirect-uri","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}