{"record":{"id":"e724d8edd6f5ebf6","repo":"different-ai/openwork","slug":"den-diagnostics-origin-must-use-https-outside-deve","errorCode":null,"errorMessage":"DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.","messagePattern":"DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"ee/apps/den-api/src/env.ts","lineNumber":409,"sourceCode":"\nfunction normalizeDiagnosticsOrigin(value: string | undefined, allowInsecureHttp: boolean) {\n  const configured = optionalString(value) ?? DEFAULT_DEN_DIAGNOSTICS_ORIGIN\n\n  let url: URL\n  try {\n    url = new URL(configured)\n  } catch {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.\")\n  }\n\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.\")\n  }\n  if (url.username || url.password || url.search || url.hash || (url.pathname !== \"/\" && url.pathname !== \"\")) {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.\")\n  }\n  if (url.protocol !== \"https:\" && !allowInsecureHttp) {\n    throw new Error(\"DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.\")\n  }\n  return url.origin\n}\n\nfunction normalizeOptionalHttpsOrigin(envName: string, value: string | undefined) {\n  const configured = optionalString(value)\n  if (!configured) {\n    return undefined\n  }\n\n  let url: URL\n  try {\n    url = new URL(configured)\n  } catch {\n    throw new Error(`${envName} must be an absolute https origin.`)\n  }\n\n  if (url.protocol !== \"https:\") {","sourceCodeStart":391,"sourceCodeEnd":427,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/env.ts#L391-L427","documentation":"Outside development (allowInsecureHttp false), normalizeDiagnosticsOrigin requires https:. A plain http:// origin is rejected to prevent diagnostics data being sent in cleartext in production deployments.","triggerScenarios":"DEN_DIAGNOSTICS_ORIGIN set to 'http://...' while NODE_ENV/deployment mode signals production, so allowInsecureHttp is false.","commonSituations":"Local dev config promoted to staging/production unchanged; internal service behind TLS-terminating proxy still configured with http.","solutions":["Serve diagnostics over TLS and set DEN_DIAGNOSTICS_ORIGIN to https://...","If the endpoint is genuinely behind a TLS-terminating proxy, point this origin at the public https URL instead of the internal http one","Only in dev/self-hosted trusted networks, enable the insecure-http allowance the app provides (allowInsecureHttp)"],"exampleFix":"// before\nDEN_DIAGNOSTICS_ORIGIN=http://diagnostics.internal\n// after\nDEN_DIAGNOSTICS_ORIGIN=https://diagnostics.internal","handlingStrategy":"validation","validationCode":"function requireHttpsOutsideDev(v: string | undefined, isDev: boolean): void {\n  if (!v || isDev) return\n  if (new URL(v).protocol !== 'https:') {\n    throw new Error('DEN_DIAGNOSTICS_ORIGIN must use https in production')\n  }\n}","typeGuard":"function isHttpsOrigin(v: string): boolean {\n  try { return new URL(v).protocol === 'https:' } catch { return false }\n}","tryCatchPattern":"try {\n  bootServer(env)\n} catch (e) {\n  if (String((e as Error).message).includes('must use HTTPS outside development')) {\n    console.error('Configure a TLS endpoint or point at the https public URL of the proxy')\n    process.exit(1)\n  }\n  throw e\n}","preventionTips":["Terminate TLS at the edge and reference the public https URL","Run production config checks in CI before deploy","Only allow http in explicitly-flagged dev/self-hosted environments"],"tags":["security","tls","configuration","env"],"backgroundTag":"https-required","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}