{"record":{"id":"f3e901ea8ada1a15","repo":"larksuite/cli","slug":"only-https-urls-are-supported","errorCode":null,"errorMessage":"only https URLs are supported","messagePattern":"only https URLs are supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/validate/url.go","lineNumber":153,"sourceCode":"\t}\n\n\tcloned := *base\n\tcloned.Transport = &downloadSchemeTransport{\n\t\tbase:      cloneDownloadTransport(base.Transport),\n\t\tallowHTTP: opts.AllowHTTP,\n\t}\n\tcloned.CheckRedirect = func(req *http.Request, via []*http.Request) error {\n\t\tif len(via) >= opts.MaxRedirects {\n\t\t\treturn fmt.Errorf(\"too many redirects\")\n\t\t}\n\t\tif len(via) > 0 {\n\t\t\tprev := via[len(via)-1]\n\t\t\tif strings.EqualFold(prev.URL.Scheme, \"https\") && strings.EqualFold(req.URL.Scheme, \"http\") {\n\t\t\t\treturn fmt.Errorf(\"redirect from https to http is not allowed\")\n\t\t\t}\n\t\t}\n\t\tif !opts.AllowHTTP && !strings.EqualFold(req.URL.Scheme, \"https\") {\n\t\t\treturn fmt.Errorf(\"only https URLs are supported\")\n\t\t}\n\t\tif err := ValidateDownloadSourceURL(req.Context(), req.URL.String()); err != nil {\n\t\t\treturn fmt.Errorf(\"blocked redirect target: %w\", err)\n\t\t}\n\t\treturn nil\n\t}\n\n\treturn &cloned\n}\n\ntype downloadSchemeTransport struct {\n\tbase      http.RoundTripper\n\tallowHTTP bool\n}\n\nfunc (t *downloadSchemeTransport) RoundTrip(req *http.Request) (*http.Response, error) {\n\tif req == nil || req.URL == nil {\n\t\treturn nil, errs.NewInternalError(","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/validate/url.go#L135-L171","documentation":"Unless AllowHTTP is enabled, the CheckRedirect policy in NewDownloadHTTPClient requires every redirect target to use https (internal/validate/url.go:153). A redirect to any non-https scheme (http, ftp, file, etc.) aborts the redirect chain with this error. It enforces the download security posture that untrusted downloads travel over TLS.","triggerScenarios":"A 3xx response whose Location header is an http:// URL (or another non-https scheme) while following redirects on a download client built with AllowHTTP unset/false.","commonSituations":"Servers redirecting to a plaintext mirror or CDN endpoint; corporate infra where internal links are http; tests hitting a local plain-http endpoint from an https start URL.","solutions":["Redirect to or start from an https:// URL; update the source URL or server config.","If plain http is intentionally required, construct the client with DownloadHTTPClientOptions{AllowHTTP: true}.","For non-http/https schemes (ftp, file), the download path is unsupported — use an appropriate tool instead."],"exampleFix":"// before\nclient := validate.NewDownloadHTTPClient(base, validate.DownloadHTTPClientOptions{})\n// after: explicitly permit plain http when needed\nclient := validate.NewDownloadHTTPClient(base, validate.DownloadHTTPClientOptions{AllowHTTP: true})","handlingStrategy":"validation","validationCode":"u, err := url.Parse(src)\nif err != nil || u.Scheme != \"https\" {\n    return fmt.Errorf(\"download source must be https, got %v\", u)\n}","typeGuard":null,"tryCatchPattern":"resp, err := client.Get(url)\nif err != nil {\n    if strings.Contains(err.Error(), \"only https URLs are supported\") {\n        // either switch to an https source or rebuild client with AllowHTTP: true\n        return fmt.Errorf(\"non-https redirect rejected: %w\", err)\n    }\n    return err\n}","preventionTips":["Enforce https in your own URL allowlist before handing URLs to the download client.","Set AllowHTTP: true only for environments where plaintext is explicitly acceptable (e.g. local tests).","Check Location headers of your endpoints to confirm all redirects stay on https."],"tags":["network","http","tls","redirect","security"],"backgroundTag":"https-required","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}