{"record":{"id":"db27d72d7e98a787","repo":"tursodatabase/turso","slug":"tls-requires-a-remote-turso-url-data-source","errorCode":null,"errorMessage":"Tls requires a remote Turso URL Data Source.","messagePattern":"Tls requires a remote Turso URL Data Source\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"bindings/dotnet/src/Turso.Data/TursoConnection.cs","lineNumber":343,"sourceCode":"        if (_connectionOptions.SyncInterval > 0)\n            throw new NotSupportedException(\"Sync Interval requires embedded replica support, which is not supported yet by the .NET provider.\");\n\n        if (_connectionOptions.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(_connectionOptions[\"Encryption Key\"]))\n            throw new InvalidOperationException(\"Encryption Cipher and Encryption Key are local database options and cannot be used with remote Turso URLs.\");\n\n        _remoteClient = new TursoRemoteClient(_connectionOptions.GetRemoteUri(), _connectionOptions.AuthToken);\n    }\n\n    private void ValidateLocalOnlyOptions()\n    {\n        if (!string.IsNullOrWhiteSpace(_connectionOptions.AuthToken))\n            throw new InvalidOperationException(\"Auth Token requires a remote Turso URL Data Source.\");\n        if (!string.IsNullOrWhiteSpace(_connectionOptions.ReplicaPath))\n            throw new InvalidOperationException(\"Replica Path requires a remote Turso URL Data Source.\");\n        if (_connectionOptions.SyncInterval > 0)\n            throw new InvalidOperationException(\"Sync Interval requires a remote embedded replica connection.\");\n        if (_connectionOptions.Tls.HasValue)\n            throw new InvalidOperationException(\"Tls requires a remote Turso URL Data Source.\");\n    }\n\n    private void CloseRemote()\n    {\n        var remoteClient = _remoteClient;\n        if (remoteClient is null)\n            return;\n\n        Exception? closeError = null;\n        try\n        {\n            if (_remoteTransactionActive)\n            {\n                remoteClient\n                    .ExecuteAsync(\"ROLLBACK\", new TursoParameterCollection(), wantRows: false, DefaultTimeout, closeAfter: true, CancellationToken.None)\n                    .GetAwaiter()\n                    .GetResult();\n            }","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/tursodatabase/turso/blob/244cde92a7df7f9b8b8b7a4075c35a12977e303e/bindings/dotnet/src/Turso.Data/TursoConnection.cs#L325-L361","documentation":"ValidateLocalOnlyOptions rejects an explicit 'Tls' value on local connections: Tls controls the transport scheme for remote URLs (for example libsql:// maps to https unless Tls=false). A local file database has no transport, so Open() throws 'Tls requires a remote Turso URL Data Source.'","triggerScenarios":"Open() with 'Data Source=app.db;Tls=true' (or false); a Tls keyword left behind after changing the Data Source from a URL to a local file; config templates that pin TLS settings on every connection.","commonSituations":"Security baselines that force 'Tls=true' on all database connections; switching between remote and local modes by editing only Data Source; copied connection strings from HTTP-tunnelled remote setups.","solutions":["Remove the 'Tls' keyword for local file databases","For remote URLs keep or adjust it: 'Tls=false' with libsql/http downgrades to plaintext HTTP","Clean mode-specific keywords whenever the Data Source mode changes"],"exampleFix":"// before\nvar cs = \"Data Source=app.db;Tls=true\";\n\n// after\nvar cs = \"Data Source=app.db\";\n// remote equivalent: \"Data Source=libsql://db.turso.io;Tls=true\"","handlingStrategy":"validation","validationCode":"var opts = TursoConnectionOptions.Parse(cs);\nif (!opts.IsRemote && opts.Tls.HasValue)\n    throw new InvalidOperationException(\n        \"Remove 'Tls' or switch Data Source to a remote URL.\");","typeGuard":"static bool TlsMatchesMode(string cs)\n{\n    var opts = TursoConnectionOptions.Parse(cs);\n    return opts.IsRemote || !opts.Tls.HasValue;\n}","tryCatchPattern":"try { conn.Open(); }\ncatch (InvalidOperationException ex) when (ex.Message == \"Tls requires a remote Turso URL Data Source.\")\n{\n    // remove 'Tls' for local databases; keep it only on remote URLs\n}","preventionTips":["Tls selects the transport scheme for remote URLs (libsql maps to https unless Tls=false)","Exclude Tls from local file connection strings","Audit security-baseline configs that force Tls on all connections"],"tags":["csharp","dotnet","turso","connection-string","tls","configuration"],"backgroundTag":"invalid-connection-string-option","analyzedSha":"244cde92a7df7f9b8b8b7a4075c35a12977e303e","analyzedAt":"2026-08-20T07:02:18.389Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}