babalae/better-genshin-impact · error · UnauthorizedAccessException

当前JS脚本不允许使用HTTP请求，请在调度器通用设置中启用“JS HTTP权限”

Error message

当前JS脚本不允许使用HTTP请求，请在调度器通用设置中启用“JS HTTP权限”

What it means

Thrown as UnauthorizedAccessException by Http.CheckHttpPermission when the current script project does not have JS HTTP permission enabled. The check reads TaskContext.Instance().CurrentScriptProject.AllowJsHTTP — if it is false or null (no project), all HTTP calls are blocked. This is a sandbox security gate: JS scripts cannot make network requests unless explicitly permitted.

Source

Thrown at BetterGenshinImpact/Core/Script/Dependence/Http.cs:25

using System.Text.Json;
using System.Collections.Generic;
using System.Net.Http;
using System.Text;
using BetterGenshinImpact.GameTask;
using Microsoft.Extensions.Logging;

namespace BetterGenshinImpact.Core.Script.Dependence;

public class Http
{
    private readonly ILogger<Http> _logger = App.GetLogger<Http>();

    private void CheckHttpPermission(string url)
    {
        var currentProject = TaskContext.Instance().CurrentScriptProject;
        if (!currentProject?.AllowJsHTTP ?? false)
        {
            throw new UnauthorizedAccessException("当前JS脚本不允许使用HTTP请求，请在调度器通用设置中启用“JS HTTP权限”");
        }
        var allowedUrls = currentProject?.Project?.Manifest.HttpAllowedUrls ?? [];
        if (allowedUrls.Length == 0)
        {
            throw new UnauthorizedAccessException("当前JS脚本没有配置允许请求的URL，请在脚本的manifest.json中配置http_allowed_urls");
        }
        if (allowedUrls.Any(allowedUrl =>
        {
            // fuzzy match
            var pattern = "^" + System.Text.RegularExpressions.Regex.Escape(allowedUrl).Replace("\\*", ".*") + "$";
            _logger.LogDebug($"[HTTP] 检查URL {url} 是否符合: {pattern}");
            var regex = new System.Text.RegularExpressions.Regex(pattern);
            return regex.IsMatch(url);
        }))
        {
            return;
        }
        throw new UnauthorizedAccessException($"当前JS脚本不允许请求此URL: {url}，请在脚本的manifest.json中配置http_allowed_urls，当前允许的URL列表: [{string.Join(", ", allowedUrls)}]");

View on GitHub (pinned to a7cb36712d)

Solutions

1. Enable 'JS HTTP权限' in the scheduler general settings (调度器通用设置 → JS HTTP权限).
2. Verify CurrentScriptProject is set — the script must run within a registered script project, not ad-hoc.
3. If permission cannot be granted, replace HTTP calls with local file reads or pre-cached data.
4. Check that the ScriptGroupProject.AllowJsHTTPHash matches the current URL allowlist hash (mismatch = permission disabled).

Example fix

// No code fix — this requires user action in settings.
// Enable: 调度器通用设置 → JS HTTP权限 = ON
// Then ensure manifest.json has http_allowed_urls configured.

// Check HTTP permission before making requests
var project = TaskContext.Instance().CurrentScriptProject;
if (project?.AllowJsHTTP != true)
{
    _logger.LogError("JS HTTP permission not enabled. Enable in scheduler settings: JS HTTP权限");
    return;
}

try
{
    var resp = http.Get(url, headers);
}
catch (UnauthorizedAccessException ex) when (ex.Message.Contains("不允许使用HTTP请求"))
{
    _logger.LogError("HTTP permission denied. Enable 'JS HTTP权限' in scheduler settings.");
}

When it happens

Trigger: Calling any HTTP method (Get, Post, etc.) from a JS script when AllowJsHTTP is false or when CurrentScriptProject is null (no active project context). The permission must be enabled in the scheduler's general settings (调度器通用设置).

Common situations: User wrote a script that uses http.get() or http.post() but hasn't enabled the 'JS HTTP权限' toggle in scheduler settings. Script runs outside a project context (manually injected). Settings were reset or the config file was modified externally.

Related errors

• 当前JS脚本没有配置允许请求的URL，请在脚本的manifest.json中配置http_allowed_urls
• 当前JS脚本不允许请求此URL: {url}，请在脚本的manifest.json中配置http_allowed_url
• 访问路径 '{relativePath}' 被拒绝
• 不被 Locator 支持的识别类型: {RecognitionObject.RecognitionType}
• 未指定按键，无法转换为VK。

AI-assisted analysis of babalae/better-genshin-impact@a7cb36712d (2026-08-13). Data as JSON: /api/errors/2e5f10e1cc6b85c4. Report an issue: GitHub.