{"record":{"id":"cbfac1f10ebcfce9","repo":"caddyserver/caddy","slug":"provisioning-ask-module-v","errorCode":null,"errorMessage":"provisioning 'ask' module: %v","messagePattern":"provisioning 'ask' module: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":331,"sourceCode":"\t}\n\tfor i, ap := range t.Automation.Policies {\n\t\terr := ap.Provision(t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning automation policy %d: %v\", i, err)\n\t\t}\n\t}\n\n\t// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)\n\tif t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != \"\" {\n\t\tt.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"preparing 'ask' endpoint: %v\", err)\n\t\t}\n\t\tperm := PermissionByHTTP{\n\t\t\tEndpoint: t.Automation.OnDemand.Ask,\n\t\t}\n\t\tif err := perm.Provision(ctx); err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning 'ask' module: %v\", err)\n\t\t}\n\t\tt.Automation.OnDemand.permission = perm\n\t}\n\n\t// session ticket ephemeral keys (STEK) service and provider\n\tif t.SessionTickets != nil {\n\t\terr := t.SessionTickets.provision(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning session tickets configuration: %v\", err)\n\t\t}\n\t}\n\n\t// ECH (Encrypted ClientHello) initialization\n\tif t.EncryptedClientHello != nil {\n\t\touterNames, err := t.EncryptedClientHello.Provision(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning Encrypted ClientHello components: %v\", err)\n\t\t}","sourceCodeStart":313,"sourceCodeEnd":349,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L313-L349","documentation":"After the ask URL is successfully replaced, Caddy constructs a PermissionByHTTP{Endpoint: ask} module and provisions it with the app context. If that Provision fails — principally endpoint URL parsing/validation — this error is returned. It is the provisioning of the legacy ask mechanism converted into the modern permission module.","triggerScenarios":"on_demand.ask set to a string that is not a parseable/valid URL for the permission module's validation (e.g. \"localhost:5555/check\" without scheme, or a URL with spaces), after the placeholder replacement succeeded.","commonSituations":"Ask endpoints written without http:// prefix; URLs containing trailing spaces from copy-paste; endpoints valid in old Caddy versions but now strictly validated.","solutions":["Make the ask value an absolute URL including scheme: http:// or https://host[:port]/path","Trim whitespace and verify with 'caddy validate'","Prefer migrating to the explicit permission module: {\"permission\": {\"module\": \"http\", \"endpoint\": \"...\"}}"],"exampleFix":"// before\n\"on_demand\": {\"ask\": \"localhost:5555/check\"}\n// after\n\"on_demand\": {\"ask\": \"http://localhost:5555/check\"}","handlingStrategy":"validation","validationCode":"if _, err := url.ParseRequestURI(tlsApp.Automation.OnDemand.Ask); err != nil {\n\treturn fmt.Errorf(\"ask must be a valid absolute URL: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Write ask endpoints as absolute URLs with scheme","Migrate to the permission module form; ask is deprecated"],"tags":["caddy","tls","on-demand","url-validation","ask-endpoint"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}