DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.

Error message

DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.

What it means

Outside development (allowInsecureHttp false), normalizeDiagnosticsOrigin requires https:. A plain http:// origin is rejected to prevent diagnostics data being sent in cleartext in production deployments.

Source

Thrown at ee/apps/den-api/src/env.ts:409

function normalizeDiagnosticsOrigin(value: string | undefined, allowInsecureHttp: boolean) {
  const configured = optionalString(value) ?? DEFAULT_DEN_DIAGNOSTICS_ORIGIN

  let url: URL
  try {
    url = new URL(configured)
  } catch {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.")
  }

  if (url.protocol !== "http:" && url.protocol !== "https:") {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must be an absolute http or https origin.")
  }
  if (url.username || url.password || url.search || url.hash || (url.pathname !== "/" && url.pathname !== "")) {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN cannot contain credentials, a path, a query string, or a fragment.")
  }
  if (url.protocol !== "https:" && !allowInsecureHttp) {
    throw new Error("DEN_DIAGNOSTICS_ORIGIN must use HTTPS outside development.")
  }
  return url.origin
}

function normalizeOptionalHttpsOrigin(envName: string, value: string | undefined) {
  const configured = optionalString(value)
  if (!configured) {
    return undefined
  }

  let url: URL
  try {
    url = new URL(configured)
  } catch {
    throw new Error(`${envName} must be an absolute https origin.`)
  }

  if (url.protocol !== "https:") {

View on GitHub (pinned to 2b7df46e8a)

Solutions

Serve diagnostics over TLS and set DEN_DIAGNOSTICS_ORIGIN to https://...
If the endpoint is genuinely behind a TLS-terminating proxy, point this origin at the public https URL instead of the internal http one
Only in dev/self-hosted trusted networks, enable the insecure-http allowance the app provides (allowInsecureHttp)

Example fix

// before
DEN_DIAGNOSTICS_ORIGIN=http://diagnostics.internal
// after
DEN_DIAGNOSTICS_ORIGIN=https://diagnostics.internal

Defensive patterns

Strategy: validation

Validate before calling

function requireHttpsOutsideDev(v: string | undefined, isDev: boolean): void {
  if (!v || isDev) return
  if (new URL(v).protocol !== 'https:') {
    throw new Error('DEN_DIAGNOSTICS_ORIGIN must use https in production')
  }
}

Type guard

function isHttpsOrigin(v: string): boolean {
  try { return new URL(v).protocol === 'https:' } catch { return false }
}

Try / catch

try {
  bootServer(env)
} catch (e) {
  if (String((e as Error).message).includes('must use HTTPS outside development')) {
    console.error('Configure a TLS endpoint or point at the https public URL of the proxy')
    process.exit(1)
  }
  throw e
}

Prevention

Terminate TLS at the edge and reference the public https URL
Run production config checks in CI before deploy
Only allow http in explicitly-flagged dev/self-hosted environments

When it happens

Trigger: DEN_DIAGNOSTICS_ORIGIN set to 'http://...' while NODE_ENV/deployment mode signals production, so allowInsecureHttp is false.

Common situations: Local dev config promoted to staging/production unchanged; internal service behind TLS-terminating proxy still configured with http.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/e724d8edd6f5ebf6. Report an issue: GitHub.