{"record":{"id":"d11970c0ba0992df","repo":"microsoft/aspire","slug":"endpoint-resolvedendpoint-endpoint-name-on-project-resource","errorCode":null,"errorMessage":"Endpoint '{resolvedEndpoint.Endpoint.Name}' on project resource '{resource.TargetResource.Name}' is exposed through Azure sandbox ingress, which terminates TLS and forwards plaintext HTTP. Add an HTTP endpoint that shares this endpoint's target port.","messagePattern":"Endpoint '(.+?)' on project resource '(.+?)' is exposed through Azure sandbox ingress, which terminates TLS and forwards plaintext HTTP\\. Add an HTTP endpoint that shares this endpoint's target port\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs","lineNumber":1497,"sourceCode":"            static endpoint => endpoint.Name!,\n            StringComparer.OrdinalIgnoreCase);\n        var unmatchedEndpointOptions = endpointOptions is null ? null : new HashSet<string>(endpointOptions.Keys, StringComparer.OrdinalIgnoreCase);\n        var resolvedEndpoints = resource.TargetResource.ResolveEndpoints();\n        var endpoints = new Dictionary<int, SandboxEndpoint>();\n        foreach (var resolvedEndpoint in resolvedEndpoints)\n        {\n            if (!resolvedEndpoint.Endpoint.IsExternal)\n            {\n                continue;\n            }\n\n            if (resource.TargetResource is ProjectResource &&\n                string.Equals(resolvedEndpoint.Endpoint.UriScheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase) &&\n                !resolvedEndpoints.Any(candidate =>\n                    string.Equals(candidate.Endpoint.UriScheme, Uri.UriSchemeHttp, StringComparison.OrdinalIgnoreCase) &&\n                    candidate.TargetPort.Value == resolvedEndpoint.TargetPort.Value))\n            {\n                throw new NotSupportedException(\n                    $\"Endpoint '{resolvedEndpoint.Endpoint.Name}' on project resource '{resource.TargetResource.Name}' is exposed through Azure sandbox ingress, which terminates TLS and forwards plaintext HTTP. \" +\n                    \"Add an HTTP endpoint that shares this endpoint's target port.\");\n            }\n\n            var targetPort = ResolveSandboxTargetPort(resource.TargetResource, resolvedEndpoint);\n\n            if (targetPort is not int resolvedTargetPort)\n            {\n                throw new InvalidOperationException($\"Endpoint '{resolvedEndpoint.Endpoint.Name}' on resource '{resource.TargetResource.Name}' does not have a target port. Configure a target port before deploying it to an Azure sandbox.\");\n            }\n\n            var protocol = ResolveSandboxPortProtocol(resource.TargetResource, resolvedEndpoint.Endpoint);\n            AzureSandboxEndpointOptions? resolvedEndpointOptions = null;\n            endpointOptions?.TryGetValue(resolvedEndpoint.Endpoint.Name, out resolvedEndpointOptions);\n            unmatchedEndpointOptions?.Remove(resolvedEndpoint.Endpoint.Name);\n            var endpoint = new SandboxEndpoint(\n                resolvedEndpoint.Endpoint.Name,\n                resolvedTargetPort,","sourceCodeStart":1479,"sourceCodeEnd":1515,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs#L1479-L1515","documentation":"Azure sandbox ingress terminates TLS and forwards plaintext HTTP to project targets. When a project resource exposes an HTTPS endpoint whose target port has no matching HTTP endpoint, the sandbox cannot forward traffic, so deployment validation throws NotSupportedException.","triggerScenarios":"Deploying a ProjectResource to an Azure sandbox where a resolved endpoint has UriScheme https and no other resolved endpoint with UriScheme http shares the same TargetPort.","commonSituations":"Project templates or WithEndpoint calls configured with only an https endpoint; projects that enable HTTPS-only endpoints locally then deployed to a sandbox.","solutions":["Add an HTTP endpoint on the project that shares the HTTPS endpoint's target port (WithEndpoint with scheme \"http\" and the same target port)","Or remove the HTTPS-only requirement and expose the endpoint as http","Or host the project in a container resource where TLS handling differs"],"exampleFix":"// before\nvar api = builder.AddProject<Projects.Api>(\"api\").WithHttpsEndpoint(port: 443, targetPort: 8080);\n// after\nvar api = builder.AddProject<Projects.Api>(\"api\")\n    .WithHttpEndpoint(targetPort: 8080)\n    .WithHttpsEndpoint(port: 443, targetPort: 8080);","handlingStrategy":"validation","validationCode":"var httpsPorts = project.Endpoints.Where(e => e.UriScheme == \"https\").Select(e => e.TargetPort);\nforeach (var port in httpsPorts)\n    if (!project.Endpoints.Any(e => e.UriScheme == \"http\" && e.TargetPort == port))\n        throw new InvalidOperationException($\"Add an http endpoint sharing target port {port} for sandbox deploy.\");","typeGuard":null,"tryCatchPattern":"try { DeploySandbox(...); } catch (NotSupportedException ex) when (ex.Message.Contains(\"terminates TLS and forwards plaintext HTTP\")) { /* add matching http endpoint */ }","preventionTips":["Always pair https endpoints with an http endpoint on the same target port for sandbox deploys","Test publish/deploy locally before CI"],"tags":["azure","sandbox","endpoint","https","tls"],"backgroundTag":"missing-required-argument","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}