{"record":{"id":"efff96fbd140d91c","repo":"nats-io/nats-server","slug":"proxy-url-scheme-must-be-http-or-https-got-s","errorCode":null,"errorMessage":"proxy URL scheme must be http or https, got: %s","messagePattern":"proxy URL scheme must be http or https, got: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":404,"sourceCode":"\t\tusers[u.Username] = struct{}{}\n\t}\n\treturn nil\n}\n\nfunc validateLeafNodeProxyOptions(remote *RemoteLeafOpts) ([]string, error) {\n\tvar warnings []string\n\n\tif remote.Proxy.URL == _EMPTY_ {\n\t\treturn warnings, nil\n\t}\n\n\tproxyURL, err := url.Parse(remote.Proxy.URL)\n\tif err != nil {\n\t\treturn warnings, fmt.Errorf(\"invalid proxy URL: %v\", err)\n\t}\n\n\tif proxyURL.Scheme != \"http\" && proxyURL.Scheme != \"https\" {\n\t\treturn warnings, fmt.Errorf(\"proxy URL scheme must be http or https, got: %s\", proxyURL.Scheme)\n\t}\n\n\tif proxyURL.Host == _EMPTY_ {\n\t\treturn warnings, fmt.Errorf(\"proxy URL must specify a host\")\n\t}\n\n\tif remote.Proxy.Timeout < 0 {\n\t\treturn warnings, fmt.Errorf(\"proxy timeout must be >= 0\")\n\t}\n\n\tif (remote.Proxy.Username == _EMPTY_) != (remote.Proxy.Password == _EMPTY_) {\n\t\treturn warnings, fmt.Errorf(\"proxy username and password must both be specified or both be empty\")\n\t}\n\n\tif len(remote.URLs) > 0 {\n\t\thasWebSocketURL := false\n\t\thasNonWebSocketURL := false\n","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L386-L422","documentation":"After a successful parse, validateLeafNodeProxyOptions requires the proxy URL scheme to be http or https; any other scheme (socks5, ftp, empty) is rejected with this error because the leaf node dialer only supports HTTP(S) CONNECT proxies. Thrown from validateLeafNode and parseRemoteLeafNodes during config validation.","triggerScenarios":"remote leafnode proxy { url } parses fine but proxyURL.Scheme is not \"http\" or \"https\" — e.g. \"socks5://proxy:1080\", \"tcp://...\", or a URL with no scheme at all.","commonSituations":"Operators assuming SOCKS proxies are supported and writing socks5:// URLs; environments where an env var like ALL_PROXY (socks scheme) is copied into the config; URLs pasted without scheme defaulting to \"\".","solutions":["Change the scheme to http:// or https:// for the proxy URL","If only a SOCKS proxy is available, deploy an HTTP CONNECT proxy instead (leafnode proxy support is HTTP(S) only)","Include the scheme explicitly, e.g. url: \"http://proxy.corp:3128\""],"exampleFix":"// before\nproxy { url: \"socks5://proxy.corp:1080\" }\n// after\nproxy { url: \"http://proxy.corp:3128\" }","handlingStrategy":"validation","validationCode":"u, err := url.Parse(cfg.LeafNodes.Proxy.URL)\nif err == nil && u.Scheme != \"http\" && u.Scheme != \"https\" {\n  return fmt.Errorf(\"proxy scheme must be http(s), got %q\", u.Scheme)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never copy SOCKS-style ALL_PROXY values into leafnode proxy config","Explicitly write the http:// or https:// scheme","Verify the proxy supports HTTP CONNECT before configuring it"],"tags":["leafnode","proxy","url-scheme","config-validation"],"backgroundTag":"unsupported-url-scheme","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}