babalae/better-genshin-impact · error · UnauthorizedAccessException

当前JS脚本不允许请求此URL: {url}，请在脚本的manifest.json中配置http_allowed_url

Error message

当前JS脚本不允许请求此URL: {url}，请在脚本的manifest.json中配置http_allowed_urls，当前允许的URL列表: [{string.Join(", ", allowedUrls)}]

What it means

Thrown as UnauthorizedAccessException by Http.CheckHttpPermission when the target URL does not match any pattern in the project's http_allowed_urls allowlist. The matching uses a fuzzy regex: each allowed URL is escaped, '*' is converted to '.*', and the full string is anchored with ^...$. If no pattern matches the requested URL, access is denied.

Source

Thrown at BetterGenshinImpact/Core/Script/Dependence/Http.cs:43

            throw new UnauthorizedAccessException("当前JS脚本不允许使用HTTP请求，请在调度器通用设置中启用“JS HTTP权限”");
        }
        var allowedUrls = currentProject?.Project?.Manifest.HttpAllowedUrls ?? [];
        if (allowedUrls.Length == 0)
        {
            throw new UnauthorizedAccessException("当前JS脚本没有配置允许请求的URL，请在脚本的manifest.json中配置http_allowed_urls");
        }
        if (allowedUrls.Any(allowedUrl =>
        {
            // fuzzy match
            var pattern = "^" + System.Text.RegularExpressions.Regex.Escape(allowedUrl).Replace("\\*", ".*") + "$";
            _logger.LogDebug($"[HTTP] 检查URL {url} 是否符合: {pattern}");
            var regex = new System.Text.RegularExpressions.Regex(pattern);
            return regex.IsMatch(url);
        }))
        {
            return;
        }
        throw new UnauthorizedAccessException($"当前JS脚本不允许请求此URL: {url}，请在脚本的manifest.json中配置http_allowed_urls，当前允许的URL列表: [{string.Join(", ", allowedUrls)}]");
    }

    public class HttpReponse
    {
        public int status_code { get; set; }
        public Dictionary<string, string> headers { get; set; } = new();
        public string body { get; set; } = "";
    }


    /// <summary>
    /// 执行HTTP请求
    /// </summary>
    /// <param name="method">HTTP方法</param>
    /// <param name="url">请求URL</param>
    /// <param name="body">请求体</param>
    /// <param name="headersJson">请求头，JSON格式</param>
    /// <returns></returns>

View on GitHub (pinned to a7cb36712d)

Solutions

Add the specific URL or a broader wildcard pattern to http_allowed_urls in manifest.json.
Use broader wildcards for flexibility: "https://*.example.com/*" or "https://api.example.com/*".
Verify the exact URL being requested (including protocol, subdomain, path) against the allowlist patterns.
Note that '*' becomes '.*' in regex — it matches any characters, not just path segments.

Example fix

// before — manifest.json
"http_allowed_urls": ["https://api.example.com/v1/*"]

// script requests
http.get("https://api.example.com/v2/data") // denied

// after — manifest.json
"http_allowed_urls": [
  "https://api.example.com/v1/*",
  "https://api.example.com/v2/*"
]
// or broader
"http_allowed_urls": ["https://api.example.com/*"]

Defensive patterns

Strategy: validation

Validate before calling

// Pre-check URL against allowlist patterns
var project = TaskContext.Instance().CurrentScriptProject;
var allowedUrls = project?.Project?.Manifest.HttpAllowedUrls ?? [];
bool isAllowed = allowedUrls.Any(pattern =>
{
    var regexPattern = "^" + Regex.Escape(pattern).Replace("\\*", ".*") + "$";
    return Regex.IsMatch(url, regexPattern);
});
if (!isAllowed)
    throw new UnauthorizedAccessException($"URL {url} not in allowlist: [{string.Join(", ", allowedUrls)}]");

Try / catch

try
{
    var resp = http.Get(url, headers);
}
catch (UnauthorizedAccessException ex) when (ex.Message.Contains("不允许请求此URL"))
{
    _logger.LogError("URL {Url} not allowed. Current allowlist: see manifest.json http_allowed_urls", url);
}

Prevention

Match exact protocol (http vs https) and subdomain in allowlist patterns.
Use broad wildcards (https://api.example.com/*) unless security requires narrower patterns.
Remember '*' matches any characters (.*), not just path segments.
Update the allowlist when API endpoints or versions change.

When it happens

Trigger: Calling http.get(url) or http.post(url) where url is not covered by any pattern in manifest.json's http_allowed_urls. For example, the allowlist has "https://api.example.com/v1/*" but the script requests "https://api.example.com/v2/data".

Common situations: URL path prefix changed (API version bump). Wildcard pattern is too narrow — e.g., "https://api.example.com/users" instead of "https://api.example.com/*". Different subdomain used (cdn.example.com vs api.example.com). HTTP vs HTTPS mismatch in the pattern.

Related errors

AI-assisted analysis of babalae/better-genshin-impact@a7cb36712d (2026-08-13). Data as JSON: /api/errors/cca85abc6c1cec3b. Report an issue: GitHub.