badges/shields · error · InvalidParameter

please use https

Error message

please use https

What it means

The endpoint service only allows https URLs unless unsecured endpoint requests are explicitly enabled server-side (_allowUnsecuredEndpointRequests). If the parsed protocol is not https: and that flag is false, it throws InvalidParameter with prettyMessage 'please use https'. This enforces secure transport for user-supplied endpoints.

Source

Thrown at services/endpoint/endpoint.service.js:193

  constructor(...args) {
    super(...args)
    const config = configModule.util.toObject()
    this._allowUnsecuredEndpointRequests =
      config?.public?.allowUnsecuredEndpointRequests || false
  }

  async handle(namedParams, { url }) {
    let protocol, hostname
    try {
      const parsedUrl = new URL(url)
      protocol = parsedUrl.protocol
      hostname = parsedUrl.hostname
    } catch (e) {
      throw new InvalidParameter({ prettyMessage: 'invalid url' })
    }
    if (protocol !== 'https:' && !this._allowUnsecuredEndpointRequests) {
      throw new InvalidParameter({ prettyMessage: 'please use https' })
    }
    if (blockedDomains.some(domain => hostname.endsWith(domain))) {
      throw new InvalidParameter({ prettyMessage: 'domain is blocked' })
    }

    const validated = await fetchEndpointData(this, {
      url,
      httpErrors,
      validationPrettyErrorMessage: 'invalid properties',
      includeKeys: true,
    })

    return this.constructor.render(validated)
  }
}

View on GitHub (pinned to 766fd8bc89)

Solutions

1. Serve the endpoint data over https and use the https URL in the badge
2. If you self-host Shields, enable the unsecured-endpoint-requests option (e.g. via the ALLOW_UNSECURED_ENDPOINT_REQUESTS-style config) only for trusted internal use
3. Proxy the http resource through an https endpoint you control

Example fix

// before
/badge/endpoint?url=http://internal.example.com/status.json
// after
/badge/endpoint?url=https://internal.example.com/status.json

function isHttpsUrl(url) {
  try { return new URL(url).protocol === 'https:' } catch { return false }
}
// if (!isHttpsUrl(cfg.url)) upgrade to https before requesting the badge

try {
  const badge = await getEndpointBadge({ url })
} catch (e) {
  if (e.prettyMessage === 'please use https') {
    const upgraded = url.replace(/^http:/, 'https:')
    // retry with upgraded, else surface configuration warning
  } else throw e
}

When it happens

Trigger: Calling /badge/endpoint with url=http://... (or any non-https scheme like ftp:) while the Shields instance does not allow unsecured endpoint requests.

Common situations: Self-hosted/internal services only exposed over http; copying an http URL from local development into the badge; enterprise instances where the allow-unsecured flag was never enabled.

Related errors

• strict ssl is required
• invalid url parameter
• requested origin not authorized
• invalid url
• domain is blocked

AI-assisted analysis of badges/shields@766fd8bc89 (2026-08-30). Data as JSON: /api/errors/064f6ee7487af1ed. Report an issue: GitHub.