{"record":{"id":"d73d15ca54a0d7b2","repo":"TechnitiumSoftware/DnsServer","slug":"cluster-node-url-must-use-https-scheme","errorCode":null,"errorMessage":"Cluster node URL must use HTTPS scheme.","messagePattern":"Cluster node URL must use HTTPS scheme\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Cluster/ClusterNode.cs","lineNumber":101,"sourceCode":"\n            if (_type == ClusterNodeType.Primary)\n            {\n                _lastSeen = DateTime.UtcNow;\n                _state = ClusterNodeState.Connected; //since this info was received from primary node\n            }\n            else\n            {\n                _state = ClusterNodeState.Unknown;\n            }\n        }\n\n        public ClusterNode(ClusterManager clusterManager, int id, Uri url, IReadOnlyList<IPAddress> ipAddresses, ClusterNodeType type, ClusterNodeState state)\n        {\n            if (url.OriginalString.Length > 255)\n                throw new ArgumentException(\"Cluster node URL length must be less than 255 bytes.\", nameof(url));\n\n            if (!url.Scheme.Equals(\"https\", StringComparison.OrdinalIgnoreCase))\n                throw new ArgumentException(\"Cluster node URL must use HTTPS scheme.\", nameof(url));\n\n            if (ipAddresses.Count > 10)\n                throw new ArgumentException(\"Cluster node cannot have more than 10 IP addresses.\", nameof(ipAddresses));\n\n            _clusterManager = clusterManager;\n\n            _id = id;\n            _url = url;\n            _ipAddresses = ipAddresses;\n            _type = type;\n            _state = state;\n        }\n\n        public ClusterNode(ClusterManager clusterManager, BinaryReader bR)\n        {\n            _clusterManager = clusterManager;\n\n            int version = bR.ReadByte();","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Cluster/ClusterNode.cs#L83-L119","documentation":"Constructor argument guard on the explicit ClusterNode overload. It requires the URL scheme to be 'https' (case-insensitive). Inter-node cluster API calls are made over TLS via HttpApiClient, and the cluster is designed to never communicate in plaintext, so http:// URLs are rejected at construction.","triggerScenarios":"Instantiating ClusterNode with a Uri whose Scheme is 'http' (or anything other than https), e.g. http://host:5380/.","commonSituations":"Local testing with http:// to avoid certificate setup; misconfigured reverse proxy/base URL that strips TLS; a node URL typed with the wrong scheme in config; importing a config file that stored an http URL.","solutions":["Use an https:// URL for the cluster node (enable TLS on the web service / supply a valid certificate).","If testing locally without TLS, use a self-signed certificate so the scheme can still be https.","Correct the config/UI entry that stored the http:// URL.","Validate url.Scheme equals 'https' before constructing the node."],"exampleFix":"// before\nvar url = new Uri(\"http://ns1.example.com:5380/\"); // plain HTTP\nvar node = new ClusterNode(mgr, id, url, ips, type, state); // throws [202]\n\n// after: enable TLS and use https\nvar url = new Uri(\"https://ns1.example.com:53443/\");\nvar node = new ClusterNode(mgr, id, url, ips, type, state);","handlingStrategy":"validation","validationCode":"static void ValidateClusterNodeUrl(Uri url)\n{\n    ArgumentNullException.ThrowIfNull(url);\n    if (!url.Scheme.Equals(\"https\", StringComparison.OrdinalIgnoreCase))\n        throw new ArgumentException(\"Cluster node URL must use HTTPS.\", nameof(url));\n}\n\nValidateClusterNodeUrl(url);\nvar node = new ClusterNode(mgr, id, url, ips, type, state);","typeGuard":"static bool IsClusterNodeUrlSecure(Uri url) =>\n    url is not null && url.Scheme.Equals(\"https\", StringComparison.OrdinalIgnoreCase);","tryCatchPattern":null,"preventionTips":["Always use https:// for cluster node URLs.","Enable TLS on every node before joining the cluster.","Audit stored cluster config for any http:// URLs."],"tags":["cluster","validation","constructor","tls","security"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}