decolua/9router · error

token_endpoint must use https

Error message

token_endpoint must use https

What it means

The token endpoint must be https; the token flow posts client credentials/secrets in the body, so http endpoints are rejected outright as a security measure.

Source

Thrown at src/lib/oauth/kiroExternalIdp.js:26

const DEFAULT_EXPIRES_IN = 3600;

function normalizeString(value) {
  return typeof value === "string" ? value.trim() : "";
}

export function validateMicrosoftTokenEndpoint(rawEndpoint) {
  const tokenEndpoint = normalizeString(rawEndpoint);
  if (!tokenEndpoint) throw new Error("token_endpoint is required");

  let parsed;
  try {
    parsed = new URL(tokenEndpoint);
  } catch {
    throw new Error("token_endpoint must be a valid URL");
  }

  if (parsed.protocol !== "https:") {
    throw new Error("token_endpoint must use https");
  }

  const host = parsed.hostname.toLowerCase();
  if (!MICROSOFT_TOKEN_ENDPOINT_HOSTS.has(host)) {
    throw new Error("token_endpoint must be a Microsoft login endpoint");
  }

  return parsed.toString();
}

export function normalizeScope(scopes) {
  if (Array.isArray(scopes)) {
    return scopes.map(normalizeString).filter(Boolean).join(" ");
  }
  return normalizeString(scopes);
}

export function decodeJwtPayload(jwt) {

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Use the https endpoint: https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token.
2. For local development, put the mock IdP behind an https terminator (e.g. a local reverse proxy with TLS) and allowlist its host.
3. Fix the upstream discovery document if it advertises an http token_endpoint (misconfigured reverse proxy offloading TLS).

Example fix

// before
validateMicrosoftTokenEndpoint("http://login.microsoftonline.com/common/oauth2/v2.0/token");
// after
validateMicrosoftTokenEndpoint("https://login.microsoftonline.com/common/oauth2/v2.0/token");

if (raw.startsWith("http://")) {
  raw = raw.replace(/^http:/, "https:"); // or refuse in dev too
}
validateMicrosoftTokenEndpoint(raw);

try {
  endpoint = validateMicrosoftTokenEndpoint(raw);
} catch (err) {
  if (err.message === "token_endpoint must use https") {
    throw new Error("Refusing to send OAuth credentials over http — configure an https token endpoint");
  }
  throw err;
}

When it happens

Trigger: token_endpoint parsed successfully but with protocol "http:" — e.g. http://localhost:.../token from a dev mock, or a misconfigured endpoint defaulting to http.

Common situations: Pointing at a local/mock IdP over plain HTTP during development; an internal proxy advertising http:// in its discovery document; copying an http example URL from documentation.

Related errors

• token_endpoint must be a Microsoft login endpoint
• xai discovery ${field} must use https: ${value}
• token_endpoint is required
• token_endpoint must be a valid URL
• `xai discovery ${field} must use https: ${value}`

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/0e6f2d83a99b1ecb. Report an issue: GitHub.