{"record":{"id":"ced16b9c9d3b2d00","repo":"Hmbown/CodeWhale","slug":"using-insecure-http-base-url-because-allow-insecu","errorCode":null,"errorMessage":"Using insecure HTTP base URL because {ALLOW_INSECURE_HTTP_ENV} is set","messagePattern":"Using insecure HTTP base URL because (.+?) is set","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/client.rs","lineNumber":674,"sourceCode":"\nfn validate_base_url_security(base_url: &str) -> Result<()> {\n    let display_base_url = redact_url_for_display(base_url);\n    if base_url.starts_with(\"https://\")\n        || base_url.starts_with(\"http://localhost\")\n        || base_url.starts_with(\"http://127.0.0.1\")\n        || base_url.starts_with(\"http://[::1]\")\n    {\n        return Ok(());\n    }\n\n    if base_url.starts_with(\"http://\")\n        && std::env::var(ALLOW_INSECURE_HTTP_ENV)\n            .or_else(|_| std::env::var(LEGACY_ALLOW_INSECURE_HTTP_ENV))\n            .ok()\n            .as_deref()\n            .is_some_and(|v| v == \"1\" || v.eq_ignore_ascii_case(\"true\"))\n    {\n        logging::warn(format!(\n            \"Using insecure HTTP base URL because {ALLOW_INSECURE_HTTP_ENV} is set\"\n        ));\n        return Ok(());\n    }\n\n    if base_url.starts_with(\"http://\") {\n        anyhow::bail!(\n            \"Refusing insecure base URL '{display_base_url}'.\\n\\\n             \\n\\\n             Loopback hosts (localhost, 127.0.0.1, [::1]) are auto-allowed.\\n\\\n             For other trusted local hosts (LAN, llama.cpp on a private IP, etc.)\\n\\\n             set the env var `{ALLOW_INSECURE_HTTP_ENV}=1` in the shell that runs codewhale and re-run.\\n\\\n             \\n\\\n             Example: `{ALLOW_INSECURE_HTTP_ENV}=1 codewhale` (note the underscores).\",\n        );\n    }\n\n    anyhow::bail!(","sourceCodeStart":656,"sourceCodeEnd":692,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/client.rs#L656-L692","documentation":"validate_base_url_security accepts https and loopback http URLs outright; for any other http:// base URL it warns (this message) only when ALLOW_INSECURE_HTTP_ENV (or its legacy alias) is set to 1/true-style values, and otherwise rejects the configuration. The message documents that the caller has explicitly opted into plaintext HTTP to a non-loopback endpoint — a deliberate security relaxation, not a malfunction.","triggerScenarios":"Thrown at crates/tui/src/client.rs:674 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Prefer an https:// base URL; the warning disappears once TLS is used","Use http://localhost / 127.0.0.1 / [::1] for local development without the env var","Remove ALLOW_INSECURE_HTTP_ENV in production; keep it only for trusted networks or test rigs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}