gchq/CyberChef · warning · OperationError

${e.toString()}\n\nThis error could be caused by one of the

Error message

${e.toString()}\n\nThis error could be caused by one of the following:\n - An invalid URL\n - Making a request to an insecure resource (HTTP) from a secure source (HTTPS)\n - Making a cross-origin request to a server which does not support CORS\n

What it means

Catch-all OperationError wrapping any exception from the underlying fetch() call. The promise .catch handler appends a hint listing the three most common fetch failure causes: invalid URL, mixed-content (HTTP target from HTTPS origin), and missing CORS support. The original error's toString() is preserved as the prefix.

Source

Thrown at src/core/operations/HTTPRequest.mjs:125

            .then(r => {
                if (r.status === 0 && r.type === "opaque") {
                    throw new OperationError("Error: Null response. Try setting the connection mode to CORS.");
                }

                if (showResponseMetadata) {
                    let headers = "";
                    for (const pair of r.headers.entries()) {
                        headers += "    " + pair[0] + ": " + pair[1] + "\n";
                    }
                    return r.text().then(b => {
                        return "####\n  Status: " + r.status + " " + r.statusText +
                            "\n  Exposed headers:\n" + headers + "####\n\n" + b;
                    });
                }
                return r.text();
            })
            .catch(e => {
                throw new OperationError(e.toString() +
                    "\n\nThis error could be caused by one of the following:\n" +
                    " - An invalid URL\n" +
                    " - Making a request to an insecure resource (HTTP) from a secure source (HTTPS)\n" +
                    " - Making a cross-origin request to a server which does not support CORS\n");
            });
    }

}


/**
 * Lookup table for HTTP modes
 *
 * @private
 */
const modeLookup = {
    "Cross-Origin Resource Sharing": "cors",
    "No CORS (limited to HEAD, GET or POST)": "no-cors",

View on GitHub (pinned to 4290ea7539)

Solutions

1. Read the preserved original error prefix to identify which of the three hint causes applies.
2. Switch the target to https:// if CyberChef is served over https (avoid mixed content).
3. Set Connection mode to CORS and confirm the server sends Access-Control-Allow-Origin.
4. Validate the URL with `new URL(url)` before invoking.
5. Test the same URL with curl to confirm the server is reachable and CORS-enabled.

Example fix

// before
run("http://example.com/api", ["GET", "http://example.com/api", "", "CORS", false]);
// after - use https and a CORS-enabled endpoint
run("https://api.example.com/data", ["GET", "https://api.example.com/data", "", "Cross-Origin Resource Sharing", false]);

function assertFetchableUrl(raw) {
  const u = new URL(raw);              // throws on invalid URL
  if (globalThis.location && globalThis.location.protocol === 'https:' && u.protocol === 'http:') {
    throw new Error('Mixed content: https page cannot fetch http target');
  }
  return u;
}

function isLikelyFetchableUrl(raw) {
  try { assertFetchableUrl(raw); return true; } catch { return false; }
}

try {
  result = await httpReq.run(url, args);
} catch (e) {
  if (e instanceof OperationError) {
    // inspect the preserved original-error prefix for the real cause
    if (/Failed to fetch/i.test(e.message)) handleNetworkOrCors();
    else if (/invalid url/i.test(e.message)) fixUrl();
    else handleMixedContent();
  } else throw e;
}

When it happens

Trigger: Malformed URL (fetch TypeError 'Failed to fetch' / 'Invalid URL'); HTTPS CyberChef page calling an HTTP endpoint (mixed content blocked); cross-origin request to a server without Access-Control-Allow-Origin; DNS failure; network offline; self-signed cert rejected.

Common situations: Typo in URL; using http:// from a hosted https CyberChef; hitting an internal/airgapped-only endpoint from the public instance; corporate proxy stripping CORS headers; certificate warnings on the target.

Related errors

• Error: Null response. Try setting the connection mode to COR
• Error making request to ${url} ${e.toString()}
• ${error.toString()} This error could be caused by one of th

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/69a543c8e940c6c7. Report an issue: GitHub.