{"record":{"id":"cb74b1cb2a77add1","repo":"hashicorp/terraform","slug":"address-must-be-http-or-https","errorCode":null,"errorMessage":"address must be HTTP or HTTPS","messagePattern":"address must be HTTP or HTTPS","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/http/backend.go","lineNumber":138,"sourceCode":"func (b *Backend) Configure(configVal cty.Value) tfdiags.Diagnostics {\n\taddress := backendbase.GetAttrEnvDefaultFallback(\n\t\tconfigVal, \"address\",\n\t\t\"TF_HTTP_ADDRESS\", cty.StringVal(\"\"),\n\t).AsString()\n\tif address == \"\" {\n\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\tfmt.Errorf(\"address argument is required\"),\n\t\t)\n\t}\n\tupdateURL, err := url.Parse(address)\n\tif err != nil {\n\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\tfmt.Errorf(\"failed to parse address URL: %s\", err),\n\t\t)\n\t}\n\tif updateURL.Scheme != \"http\" && updateURL.Scheme != \"https\" {\n\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\tfmt.Errorf(\"address must be HTTP or HTTPS\"),\n\t\t)\n\t}\n\n\tupdateMethod := backendbase.GetAttrEnvDefaultFallback(\n\t\tconfigVal, \"update_method\",\n\t\t\"TF_HTTP_UPDATE_METHOD\", cty.StringVal(\"POST\"),\n\t).AsString()\n\n\tvar lockURL *url.URL\n\tif v := backendbase.GetAttrEnvDefault(configVal, \"lock_address\", \"TF_HTTP_LOCK_ADDRESS\"); !v.IsNull() {\n\t\tvar err error\n\t\tlockURL, err = url.Parse(v.AsString())\n\t\tif err != nil {\n\t\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\t\tfmt.Errorf(\"failed to parse lock_address URL: %s\", err),\n\t\t\t)\n\t\t}\n\t\tif lockURL.Scheme != \"http\" && lockURL.Scheme != \"https\" {","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/http/backend.go#L120-L156","documentation":"After parsing address, Configure() restricts the scheme to 'http' or 'https'. Any other scheme (ftp, file, ws, missing scheme so it parses as path) is rejected because the HTTP backend only speaks HTTP(S). A missing scheme often manifests as the parsed URL having Scheme == \"\" which fails this check.","triggerScenarios":"address is 'file:///path', 'ftp://host', or has no scheme like 'state.example.com/?type=axios' (parses as path with empty scheme). Triggered during 'terraform init'.","commonSituations":"User omitted the https:// prefix; copy-pasted a URL that lost its scheme; intentional use of a non-HTTP protocol by mistake.","solutions":["Prefix the address with 'https://' (preferred) or 'http://' (insecure, not recommended).","Confirm there's no leading whitespace or stray character eating the scheme.","Use https for any real endpoint; reserve http for local testing only."],"exampleFix":"// before\naddress = \"state.example.com/?type=axios\"   // no scheme\n\n// after\naddress = \"https://state.example.com/?type=axios\"","handlingStrategy":"validation","validationCode":"import \"net/url\"\nu, err := url.Parse(address)\nif err != nil { log.Fatal(err) }\nif u.Scheme != \"http\" && u.Scheme != \"https\" {\n    log.Fatalf(\"address scheme must be http or https, got %q\", u.Scheme)\n}","typeGuard":"func isHTTPScheme(s string) bool {\n    u, err := url.Parse(s)\n    return err == nil && (u.Scheme == \"http\" || u.Scheme == \"https\")\n}","tryCatchPattern":null,"preventionTips":["Always include the https:// prefix.","Use a config template that hard-codes the scheme.","Prefer https; reserve http for local dev only."],"tags":["http","backend","url","scheme","config-validation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}