{"record":{"id":"e58bc2fa021677d4","repo":"windmill-labs/windmill","slug":"http-proxy-url-cannot-contain-https-scheme","errorCode":null,"errorMessage":"HTTP_PROXY url cannot contain https scheme.","messagePattern":"HTTP_PROXY url cannot contain https scheme\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-worker/src/java_executor.rs","lineNumber":953,"sourceCode":"        match ident {\n            \"HTTPS_PROXY\" => {\n                if !val.contains(\"://\") {\n                    val = format!(\"https://{val}\");\n                }\n                let mut url = url::Url::parse(&val)?;\n                let port = url.port();\n                {\n                    url.set_port(None).unwrap_or_default();\n                    let host = url.as_str().replace(\"https://\", \"\").replace(\"http://\", \"\");\n                    jps.https_host = Some(host);\n                    if let Some(port) = port {\n                        jps.https_port = Some(format!(\"{}\", port));\n                    }\n                }\n            }\n            \"HTTP_PROXY\" => {\n                if val.contains(\"https://\") {\n                    bail!(\"HTTP_PROXY url cannot contain https scheme.\");\n                }\n                if !val.contains(\"http://\") {\n                    val = format!(\"http://{val}\");\n                }\n                let mut url = url::Url::parse(&val)?;\n                let port = url.port();\n                // Make sure port and schema is not included in final url\n                {\n                    url.set_port(None).unwrap_or_default();\n                    jps.http_host = Some(url.as_str().replace(\"http://\", \"\"));\n                    if let Some(port) = port {\n                        jps.https_port = Some(format!(\"{}\", port));\n                    }\n                }\n            }\n            // Java uses | instead of ,\n            \"NO_PROXY\" => jps.no_proxy = Some(val.replace(\",\", \"|\")),\n            _ => {}","sourceCodeStart":935,"sourceCodeEnd":971,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-worker/src/java_executor.rs#L935-L971","documentation":"Windmill translates the standard proxy environment variables into Java system properties (`-Dhttp.proxyHost` etc.) for Java jobs. HTTP_PROXY must point at an http-scheme proxy URL; if the value contains `https://`, the parser rejects it because Java's http.proxy* settings only apply to plain-HTTP proxy endpoints and mixing schemes would silently misroute traffic.","triggerScenarios":"A worker environment has `HTTP_PROXY=https://...` set (commonly one TLS-terminating proxy URL exported for both HTTP_PROXY and HTTPS_PROXY) and any Java job runs, since parse_proxy is called by resolve, install, and run paths.","commonSituations":"Ops teams setting all proxy vars to the same `https://proxy:port` URL; Docker/corporate images exporting an https-scheme HTTP_PROXY; copy-pasting the HTTPS_PROXY value into HTTP_PROXY.","solutions":["Change HTTP_PROXY in the worker environment to use the `http://` scheme, e.g. `http://proxy.corp:8080` (keep `HTTPS_PROXY=https://...` if the proxy itself is TLS)","If the proxy is plain HTTP and the value lacks any scheme, leave it scheme-less — Windmill prepends `http://` automatically","Restart the worker after fixing the env so the proxy vars are re-read"],"exampleFix":"# before (worker env)\nHTTP_PROXY=https://proxy.corp:8080\n# after\nHTTP_PROXY=http://proxy.corp:8080\nHTTPS_PROXY=http://proxy.corp:8080","handlingStrategy":"validation","validationCode":"#!/bin/sh\n# worker startup guard\ncase \"$HTTP_PROXY\" in\n  https://*) echo \"HTTP_PROXY must not use https scheme\"; exit 1;;\nesac","typeGuard":"fn is_valid_http_proxy(v: &str) -> bool {\n    !v.contains(\"https://\") && (v.contains(\"http://\") || !v.contains(\"://\"))\n}","tryCatchPattern":null,"preventionTips":["Never set HTTP_PROXY to an https:// URL; use scheme-less host:port or http://","Keep TLS-proxy config in HTTPS_PROXY only","Document proxy env conventions for worker provisioning (Ansible/Helm values)","After changing proxy env, run a trivial Java job to confirm jobs start"],"tags":["java","proxy","environment-variables","configuration"],"backgroundTag":"invalid-proxy-url-scheme","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}