gchq/CyberChef · warning · OperationError

\n\nThis error could be caused by one of the following:\n -…

Error message

${e.toString()}\n\nThis error could be caused by one of the following:\n - An invalid URL\n - Making a request to an insecure resource (HTTP) from a secure source (HTTPS)\n - Making a cross-origin request to a server which does not support CORS\n

What it means

Catch-all OperationError wrapping any exception from the underlying fetch() call. The promise .catch handler appends a hint listing the three most common fetch failure causes: invalid URL, mixed-content (HTTP target from HTTPS origin), and missing CORS support. The original error's toString() is preserved as the prefix.

Solutions

  1. Read the preserved original error prefix to identify which of the three hint causes applies.
  2. Switch the target to https:// if CyberChef is served over https (avoid mixed content).
  3. Set Connection mode to CORS and confirm the server sends Access-Control-Allow-Origin.
  4. Validate the URL with `new URL(url)` before invoking.
  5. Test the same URL with curl to confirm the server is reachable and CORS-enabled.

Example fix

// before
run("http://example.com/api", ["GET", "http://example.com/api", "", "CORS", false]);
// after - use https and a CORS-enabled endpoint
run("https://api.example.com/data", ["GET", "https://api.example.com/data", "", "Cross-Origin Resource Sharing", false]);
Defensive patterns

Strategy: try-catch

Validate before calling

function assertFetchableUrl(raw) {
  const u = new URL(raw);              // throws on invalid URL
  if (globalThis.location && globalThis.location.protocol === 'https:' && u.protocol === 'http:') {
    throw new Error('Mixed content: https page cannot fetch http target');
  }
  return u;
}

Type guard

function isLikelyFetchableUrl(raw) {
  try { assertFetchableUrl(raw); return true; } catch { return false; }
}

Try / catch

try {
  result = await httpReq.run(url, args);
} catch (e) {
  if (e instanceof OperationError) {
    // inspect the preserved original-error prefix for the real cause
    if (/Failed to fetch/i.test(e.message)) handleNetworkOrCors();
    else if (/invalid url/i.test(e.message)) fixUrl();
    else handleMixedContent();
  } else throw e;
}

Prevention

When it happens

Trigger: Malformed URL (fetch TypeError 'Failed to fetch' / 'Invalid URL'); HTTPS CyberChef page calling an HTTP endpoint (mixed content blocked); cross-origin request to a server without Access-Control-Allow-Origin; DNS failure; network offline; self-signed cert rejected.

Common situations: Typo in URL; using http:// from a hosted https CyberChef; hitting an internal/airgapped-only endpoint from the public instance; corporate proxy stripping CORS headers; certificate warnings on the target.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/69a543c8e940c6c7. Report an issue: GitHub.

Appendix: source

Thrown at src/core/operations/HTTPRequest.mjs:125

            .then(r => {
                if (r.status === 0 && r.type === "opaque") {
                    throw new OperationError("Error: Null response. Try setting the connection mode to CORS.");
                }

                if (showResponseMetadata) {
                    let headers = "";
                    for (const pair of r.headers.entries()) {
                        headers += "    " + pair[0] + ": " + pair[1] + "\n";
                    }
                    return r.text().then(b => {
                        return "####\n  Status: " + r.status + " " + r.statusText +
                            "\n  Exposed headers:\n" + headers + "####\n\n" + b;
                    });
                }
                return r.text();
            })
            .catch(e => {
                throw new OperationError(e.toString() +
                    "\n\nThis error could be caused by one of the following:\n" +
                    " - An invalid URL\n" +
                    " - Making a request to an insecure resource (HTTP) from a secure source (HTTPS)\n" +
                    " - Making a cross-origin request to a server which does not support CORS\n");
            });
    }

}


/**
 * Lookup table for HTTP modes
 *
 * @private
 */
const modeLookup = {
    "Cross-Origin Resource Sharing": "cors",
    "No CORS (limited to HEAD, GET or POST)": "no-cors",

View on GitHub (pinned to 4290ea7539)