{"record":{"id":"97a6b0c42b99b438","repo":"golang/go","slug":"insecure-url-s","errorCode":null,"errorMessage":"insecure URL: %s","messagePattern":"insecure URL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/web/http.go","lineNumber":223,"sourceCode":"\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: %v\\n\", secure.Redacted(), err)\n\t\t\t}\n\t\t\tif security != Insecure || url.Scheme == \"https\" {\n\t\t\t\t// HTTPS failed, and we can't fall back to plain HTTP.\n\t\t\t\t// Report the error from the HTTPS attempt.\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t}\n\n\tif res == nil {\n\t\tswitch url.Scheme {\n\t\tcase \"http\":\n\t\t\tif security == SecureOnly {\n\t\t\t\tif cfg.BuildX {\n\t\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: insecure\\n\", url.Redacted())\n\t\t\t\t}\n\t\t\t\treturn nil, fmt.Errorf(\"insecure URL: %s\", url.Redacted())\n\t\t\t}\n\t\tcase \"\":\n\t\t\tif security != Insecure {\n\t\t\t\tpanic(\"should have returned after HTTPS failure\")\n\t\t\t}\n\t\tdefault:\n\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: unsupported\\n\", url.Redacted())\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"unsupported scheme: %s\", url.Redacted())\n\t\t}\n\n\t\tinsecure := new(urlpkg.URL)\n\t\t*insecure = *url\n\t\tinsecure.Scheme = \"http\"\n\t\tif insecure.User != nil && security != Insecure {\n\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: insecure credentials\\n\", insecure.Redacted())","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/web/http.go#L205-L241","documentation":"Thrown by cmd/go/internal/web.get when a URL with scheme 'http' is fetched in SecureOnly security mode. SecureOnly is the default mode for module fetching: it rejects plain HTTP to prevent credential and code injection over unencrypted links. The error is returned (not printed) so callers can wrap it with request context.","triggerScenarios":"Calling web.get/web.Get/web.GetBytes/web.GetMaybe with a URL whose Scheme==\"http\" while security==SecureOnly (the zero value). Happens when a go.mod has a plain-HTTP replace directive or a vanity import resolves to http:// without the host being listed in GOINSECURE.","commonSituations":"A private module server reachable only over HTTP inside a corp network; a git-over-HTTP vanity URL; CI environments where TLS termination is unavailable. The user forgot to set GOINSECURE=<host> or GOPROXY=https://...","solutions":["Set GOINSECURE=<host>[,<host>...] env var so the host is fetched in Insecure mode (allows HTTP fallback and skips TLS verify).","Switch the module/replace URL to https:// — the preferred fix.","Route through an HTTPS-speaking GOPROXY (e.g. Athens, Athens-like proxy) that then talks HTTP upstream.","For vanity imports, fix the go-import meta tag on the server to advertise https."],"exampleFix":"// before: go.mod\nreplace example.com/m => http://internal.corp/m\n\n// after (option A — HTTPS)\nreplace example.com/m => https://internal.corp/m\n\n// after (option B — allow HTTP for that host)\n// $ GOINSECURE=internal.corp go build","handlingStrategy":"validation","validationCode":"// Validate URL scheme and security policy before fetching.\nfunc isFetchAllowed(u *urlpkg.URL, allowInsecure map[string]bool) error {\n    switch u.Scheme {\n    case \"https\", \"\":\n        return nil\n    case \"http\":\n        if !allowInsecure[u.Hostname()] {\n            return fmt.Errorf(\"refusing plain-HTTP fetch for %s without GOINSECURE opt-in\", u)\n        }\n        return nil\n    default:\n        return fmt.Errorf(\"unsupported scheme %q\", u.Scheme)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default to https:// in every go.mod replace directive and vanity import.","Maintain a documented list of hosts requiring GOINSECURE and audit it regularly.","In CI, fail the build if a module resolves to plain HTTP unexpectedly (grep go.sum / go env).","Prefer a corporate HTTPS proxy over allowing plain HTTP per-host."],"tags":["network","security","modules","tls","http"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T11:17:21.771Z"}