docusealco/docuseal · error · DownloadUtils::UnableToDownload

Error loading: #{uri}. Only HTTPS is allowed.

Error message

Error loading: #{uri}. Only HTTPS is allowed.

What it means

validate_uri! in DownloadUtils rejects any download URL that is not https on port 443 (or default port), appending '. Only HTTPS is allowed.' to the message. The check runs up front and again on every redirect hop (the follow_redirects callback re-validates), and only when validation is active - call and conn default validate: to Docuseal.multitenant?, so it is enforced on multitenant installs and skipped on plain self-hosted ones. An https URL that redirects to http:// also raises this.

Source

Thrown at lib/download_utils.rb:55

  def call(url, validate: Docuseal.multitenant?)
    uri = begin
      URI(url)
    rescue URI::Error
      Addressable::URI.parse(url).normalize
    end

    validate_uri!(uri) if validate

    resp = conn(validate:).get(uri)

    raise UnableToDownload, "Error loading: #{uri}" if resp.status >= 400

    resp
  end

  def validate_uri!(uri)
    raise UnableToDownload, "Error loading: #{uri}. Only HTTPS is allowed." if uri.scheme != 'https' ||
                                                                               [443, nil].exclude?(uri.port)
    raise UnableToDownload, "Error loading: #{uri}. Can't download from localhost." if uri.host.in?(LOCALHOSTS)
  end

  def conn(validate: Docuseal.multitenant?)
    Faraday.new do |faraday|
      faraday.response :follow_redirects, callback: lambda { |_, new_env|
        validate_uri!(new_env[:url]) if validate
      }
    end
  end
end

View on GitHub (pinned to 004a22c1c8)

Solutions

1. Serve the file over plain HTTPS on port 443 (https://host/file, no port suffix) and use that URL.
2. Fix redirect chains so every hop stays https.
3. If you genuinely need internal http sources on a self-hosted install, understand validation is skipped only because Docuseal.multitenant? is false - do not flip that flag to work around it.
4. For local files, upload directly instead of downloading by URL.

Example fix

# before
attach_url: 'http://files.example.com/doc.pdf'

# after
attach_url: 'https://files.example.com/doc.pdf'

uri = URI(url)
raise UnableToDownload, 'https required' unless uri.scheme == 'https' && [443, nil].include?(uri.port)

rescue UnableToDownload => e
  show_user_friendly_message(e.message) # includes the offending URI

When it happens

Trigger: Passing http://example.com/file.pdf; https on a custom port such as 8443; an https URL whose redirect chain drops to http; code tested on self-hosted (validation off) then run in multitenant mode.

Common situations: Internal tooling pointing at plain-HTTP intranet file sources; test environments without TLS; redirect chains through http intermediates; assuming self-hosted behavior is universal.

Related errors

• Error loading: #{uri}. Can't download from localhost.
• File type '.#{extension}' is not allowed.
• Error loading: #{uri}
• File type '.#{extension}' is not allowed.
• File type '.#{detected_extensions.first}' is not allowed.

AI-assisted analysis of docusealco/docuseal@004a22c1c8 (2026-08-21). Data as JSON: /api/errors/6ede1c261c997a46. Report an issue: GitHub.