babalae/better-genshin-impact · error · UnauthorizedAccessException

当前JS脚本没有配置允许请求的URL，请在脚本的manifest.json中配置http_allowed_urls

Error message

当前JS脚本没有配置允许请求的URL，请在脚本的manifest.json中配置http_allowed_urls

What it means

Thrown as UnauthorizedAccessException by Http.CheckHttpPermission when AllowJsHTTP is enabled but the project's manifest.json has no http_allowed_urls entries (or the array is absent/empty). Even with global HTTP permission, each script must declare which URLs it may access — an empty allowlist blocks everything.

Source

Thrown at BetterGenshinImpact/Core/Script/Dependence/Http.cs:30

using Microsoft.Extensions.Logging;

namespace BetterGenshinImpact.Core.Script.Dependence;

public class Http
{
    private readonly ILogger<Http> _logger = App.GetLogger<Http>();

    private void CheckHttpPermission(string url)
    {
        var currentProject = TaskContext.Instance().CurrentScriptProject;
        if (!currentProject?.AllowJsHTTP ?? false)
        {
            throw new UnauthorizedAccessException("当前JS脚本不允许使用HTTP请求，请在调度器通用设置中启用“JS HTTP权限”");
        }
        var allowedUrls = currentProject?.Project?.Manifest.HttpAllowedUrls ?? [];
        if (allowedUrls.Length == 0)
        {
            throw new UnauthorizedAccessException("当前JS脚本没有配置允许请求的URL，请在脚本的manifest.json中配置http_allowed_urls");
        }
        if (allowedUrls.Any(allowedUrl =>
        {
            // fuzzy match
            var pattern = "^" + System.Text.RegularExpressions.Regex.Escape(allowedUrl).Replace("\\*", ".*") + "$";
            _logger.LogDebug($"[HTTP] 检查URL {url} 是否符合: {pattern}");
            var regex = new System.Text.RegularExpressions.Regex(pattern);
            return regex.IsMatch(url);
        }))
        {
            return;
        }
        throw new UnauthorizedAccessException($"当前JS脚本不允许请求此URL: {url}，请在脚本的manifest.json中配置http_allowed_urls，当前允许的URL列表: [{string.Join(", ", allowedUrls)}]");
    }

    public class HttpReponse
    {
        public int status_code { get; set; }

View on GitHub (pinned to a7cb36712d)

Solutions

1. Add http_allowed_urls to the script's manifest.json with the required URL patterns.
2. Use wildcard patterns for flexible matching: "https://api.example.com/*".
3. Verify the manifest.json is valid JSON and the field name is exactly http_allowed_urls.
4. Reload the script project after editing manifest.json.

Example fix

// before — manifest.json
{
  "name": "my-script",
  "version": "1.0"
}

// after — manifest.json
{
  "name": "my-script",
  "version": "1.0",
  "http_allowed_urls": [
    "https://api.example.com/*",
    "https://cdn.example.com/*"
  ]
}

// Check URL allowlist configuration before HTTP calls
var project = TaskContext.Instance().CurrentScriptProject;
var allowedUrls = project?.Project?.Manifest.HttpAllowedUrls ?? [];
if (allowedUrls.Length == 0)
{
    _logger.LogError("No http_allowed_urls configured in manifest.json");
    return;
}

try
{
    var resp = http.Get(url, headers);
}
catch (UnauthorizedAccessException ex) when (ex.Message.Contains("没有配置允许请求的URL"))
{
    _logger.LogError("Add http_allowed_urls to manifest.json with required URL patterns.");
}

When it happens

Trigger: HTTP permission is enabled in settings, but the script's manifest.json either has no http_allowed_urls field, has it set to an empty array [], or the manifest was not loaded correctly.

Common situations: Developer enabled JS HTTP permission but forgot to add URLs to manifest.json. Manifest file is malformed and the field wasn't parsed. Script was copied from another project without updating its URL allowlist.

Related errors

• 当前JS脚本不允许请求此URL: {url}，请在脚本的manifest.json中配置http_allowed_url
• 当前JS脚本不允许使用HTTP请求，请在调度器通用设置中启用“JS HTTP权限”
• 不被 Locator 支持的识别类型: {RecognitionObject.RecognitionType}
• 未指定按键，无法转换为VK。
• 不支持的 OCR 引擎类型

AI-assisted analysis of babalae/better-genshin-impact@a7cb36712d (2026-08-13). Data as JSON: /api/errors/f64e00007d396eda. Report an issue: GitHub.