{"record":{"id":"9a13155e4a91192f","repo":"JuliusBrussee/caveman","slug":"objectstore-production-endpoint-must-be-an-https","errorCode":null,"errorMessage":"objectstore: production endpoint must be an HTTPS origin without credentials, path, query, or fragment","messagePattern":"objectstore: production endpoint must be an HTTPS origin without credentials, path, query, or fragment","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/objectstore/objectstore.go","lineNumber":207,"sourceCode":"\tif strings.TrimSpace(cfg.Endpoint) == \"\" || strings.TrimSpace(cfg.Bucket) == \"\" {\n\t\treturn errors.New(\"objectstore: endpoint and bucket are required\")\n\t}\n\tif strings.TrimSpace(cfg.AccessKey) == \"\" || strings.TrimSpace(cfg.SecretKey) == \"\" {\n\t\treturn errors.New(\"objectstore: access key and secret key are required\")\n\t}\n\tif !production {\n\t\treturn nil\n\t}\n\tif !cfg.UseSSL || strings.HasPrefix(strings.ToLower(strings.TrimSpace(cfg.Endpoint)), \"http://\") {\n\t\treturn errors.New(\"objectstore: production requires TLS\")\n\t}\n\traw := strings.TrimSpace(cfg.Endpoint)\n\tif !strings.Contains(raw, \"://\") {\n\t\traw = \"https://\" + raw\n\t}\n\tu, err := url.Parse(raw)\n\tif err != nil || u.Scheme != \"https\" || u.Hostname() == \"\" || u.User != nil || u.RawQuery != \"\" || u.Fragment != \"\" || (u.Path != \"\" && u.Path != \"/\") {\n\t\treturn errors.New(\"objectstore: production endpoint must be an HTTPS origin without credentials, path, query, or fragment\")\n\t}\n\treturn nil\n}\n\n// New constructs a MinIO/S3-backed Store. FromEnv adds a live production probe.\nfunc New(cfg Config) (Store, error) {\n\tendpoint := strings.TrimPrefix(strings.TrimPrefix(cfg.Endpoint, \"https://\"), \"http://\")\n\tclient, err := minio.New(endpoint, &minio.Options{\n\t\tCreds:  credentials.NewStaticV4(cfg.AccessKey, cfg.SecretKey, \"\"),\n\t\tSecure: cfg.UseSSL,\n\t\tRegion: cfg.Region,\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"objectstore: minio client: %w\", err)\n\t}\n\treturn &minioStore{client: client, bucket: cfg.Bucket}, nil\n}\n","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/shared/platform/objectstore/objectstore.go#L189-L225","documentation":"In production, validateConfig parses the endpoint as a URL and requires it to be a clean HTTPS origin: scheme https, non-empty hostname, no userinfo (credentials embedded in URL), no query string, no fragment, and a path that is empty or exactly '/'. Anything else is rejected to prevent malformed or credential-leaking endpoints reaching the S3 client.","triggerScenarios":"Endpoint like https://user:pass@host, https://host/some/prefix, https://host?x=1, or https://host#frag in production; a URL that fails url.Parse or whose scheme resolves to non-https (e.g. http:// despite UseSSL); endpoint missing a hostname entirely.","commonSituations":"Embedding credentials in the endpoint URL instead of using access/secret keys; pointing at an S3 path-style URL with a bucket in the path; proxy URLs with query parameters pasted into S3_ENDPOINT.","solutions":["Use a bare HTTPS origin: scheme https, hostname only, optional trailing '/', no credentials/query/fragment/path prefix.","Move credentials out of the URL into S3_ACCESS_KEY / S3_SECRET_ACCESS_KEY.","If a path prefix is genuinely needed (e.g. reverse proxy), configure it at the network/DNS level or drop it — the S3 path must be the origin root.","Validate the endpoint string with url.Parse in your deploy tooling before rollout."],"exampleFix":"// before\nS3_ENDPOINT=https://user:pass@minio.internal/artifacts\n// after\nS3_ENDPOINT=https://minio.internal\n# credentials via S3_ACCESS_KEY / S3_SECRET_ACCESS_KEY","handlingStrategy":"validation","validationCode":"u, err := url.Parse(cfg.Endpoint)\nif err != nil || u.Scheme != \"https\" || u.Hostname() == \"\" || u.User != nil || u.RawQuery != \"\" || u.Fragment != \"\" || (u.Path != \"\" && u.Path != \"/\") {\n    return errors.New(\"endpoint must be a bare HTTPS origin\")\n}","typeGuard":null,"tryCatchPattern":"store, err := objectstore.New(cfg)\nif err != nil {\n    return fmt.Errorf(\"object store endpoint invalid: %w\", err)\n}","preventionTips":["Use bare https origins (host[:port]) in S3_ENDPOINT — no paths, query, fragments, or userinfo","Never embed credentials in the endpoint URL; use access/secret keys","Validate endpoint URLs in deploy tooling before rollout"],"tags":["objectstore","configuration","url","security"],"backgroundTag":"invalid-url-format","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}