{"record":{"id":"b774b0a5ab390a77","repo":"appsmithorg/appsmith","slug":"the-path-path-must-start-with-https","errorCode":null,"errorMessage":"The ${path} path must start with 'https://'.","messagePattern":"The (.+?) path must start with 'https://'\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"app/client/packages/utils/src/validateApiPath/validateApiPath.ts","lineNumber":13,"sourceCode":"/**\n * Validates if the given path starts with \"https://\".\n * Throws an error if the path does not start with \"https://\".\n *\n * @param path - The path to validate.\n * @returns path if the path starts with \"https://\".\n * @throws Error if the path does not start with \"https://\".\n */\nexport const validateApiPath = (path: string): string => {\n  if (path.startsWith(\"https://\")) {\n    return path;\n  } else {\n    throw new Error(`The ${path} path must start with 'https://'.`);\n  }\n};\n","sourceCodeStart":1,"sourceCodeEnd":16,"githubUrl":"https://github.com/appsmithorg/appsmith/blob/8cd9021c24cdbea1c3c12c966073708e83db60c2/app/client/packages/utils/src/validateApiPath/validateApiPath.ts#L1-L16","documentation":"Thrown by validateApiPath() in @appsmith/utils. The function is a strict guard: it returns the path only if it starts with the literal 'https://', otherwise it throws naming the offending path. It exists to force API/redirect paths onto a secure HTTPS origin.","triggerScenarios":"Passing a path that begins with 'http://', a protocol-relative '//host', a root-relative '/api', or a bare 'host/path' to validateApiPath(). Any value whose first 8 chars are not 'https://' throws.","commonSituations":"Configuring an API datasource or redirect with an HTTP URL; building a URL from a dynamic/env base that omitted the scheme; copying a URL that lost its protocol in editing; using a localhost dev URL over http.","solutions":["Prefix the path with 'https://', e.g. 'https://api.example.com/v1'.","If a dev http origin is genuinely required, that is unsupported by this validator — coordinate with the API to expose HTTPS, or route through an HTTPS proxy.","Normalize the value upstream so it always carries the scheme before reaching validateApiPath().","Trim leading whitespace/newlines from the input before validating, since a leading space breaks startsWith."],"exampleFix":"// before\nvalidateApiPath('api.example.com/users')   // throws\nvalidateApiPath('http://api.example.com/users') // throws\n\n// after\nvalidateApiPath('https://api.example.com/users') // returns the path","handlingStrategy":"type-guard","validationCode":"function ensureHttps(p: string): string {\n  if (!p.startsWith('https://')) throw new Error(`Path must start with https://: ${p}`);\n  return p;\n}","typeGuard":"const isHttpsUrl = (p: string): p is `https://${string}` =>\n  typeof p === 'string' && p.startsWith('https://');","tryCatchPattern":"try { validateApiPath(path); } catch (e) {\n  if (/must start with 'https:\\/\\//i.test(e.message)) path = `https://${path.replace(/^https?:?\\/\\/, '')}`;\n  else throw e;\n}","preventionTips":["Normalize URLs to include the https:// scheme upstream of validation.","Trim leading whitespace before checking the prefix.","Use the isHttpsUrl type guard to narrow at the boundary."],"tags":["validation","security","https","url","typescript"],"backgroundTag":null,"analyzedSha":"8cd9021c24cdbea1c3c12c966073708e83db60c2","analyzedAt":"2026-08-12T22:14:19.293Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}