golang/go · error

refusing to pass credentials to insecure URL: %s

Error message

refusing to pass credentials to insecure URL: %s

What it means

Returned by web.get after the HTTPS attempt failed and the code is preparing an HTTP fallback. If the URL carries embedded userinfo (url.User != nil) and security mode is not Insecure, the go command refuses to send those credentials over plain HTTP. This prevents leaking tokens/passwords onto the wire.

Source

Thrown at src/cmd/go/internal/web/http.go:243

		case "":
			if security != Insecure {
				panic("should have returned after HTTPS failure")
			}
		default:
			if cfg.BuildX {
				fmt.Fprintf(os.Stderr, "# get %s: unsupported\n", url.Redacted())
			}
			return nil, fmt.Errorf("unsupported scheme: %s", url.Redacted())
		}

		insecure := new(urlpkg.URL)
		*insecure = *url
		insecure.Scheme = "http"
		if insecure.User != nil && security != Insecure {
			if cfg.BuildX {
				fmt.Fprintf(os.Stderr, "# get %s: insecure credentials\n", insecure.Redacted())
			}
			return nil, fmt.Errorf("refusing to pass credentials to insecure URL: %s", insecure.Redacted())
		}

		res, err = fetch(insecure)
		if err == nil {
			fetched = insecure
		} else {
			if cfg.BuildX {
				fmt.Fprintf(os.Stderr, "# get %s: %v\n", insecure.Redacted(), err)
			}
			// HTTP failed, and we already tried HTTPS if applicable.
			// Report the error from the HTTP attempt.
			return nil, err
		}
	}

	// Note: accepting a non-200 OK here, so people can serve a
	// meta import in their http 404 page.
	if cfg.BuildX {

View on GitHub (pinned to b6b368adc5)

Solutions

1. Add the host to GOINSECURE only if you accept the credential exposure (Insecure mode allows it) — generally avoid.
2. Move credentials out of the URL into GOAUTH (go 1.24+) or a .netrc, and use HTTPS.
3. Fix the HTTPS endpoint so the HTTP fallback is never attempted.
4. Remove the userinfo from the URL and authenticate via GOPROXY with a credential helper.

Example fix

// before
export GOPROXY=https://user:token@proxy.corp,direct
// HTTPS down → HTTP fallback refused with credentials

// after — use GOAUTH instead
// $GOPATH/config/goauth
// basic host proxy.corp user pass
export GOPROXY=https://proxy.corp,direct

func assertNoCredentialsInURL(u *urlpkg.URL) error {
    if u.User != nil {
        return fmt.Errorf("URL %s embeds credentials; move to .netrc/GOAUTH", u.Redacted())
    }
    return nil
}

When it happens

Trigger: A URL like 'https://user:token@host/m' whose HTTPS fetch failed, triggering the http:// fallback, while GOINSECURE does not cover the host. The userinfo would otherwise be retransmitted unencrypted.

Common situations: Embedding a deploy token in the module URL for a private proxy; using 'git+https' style authenticated URLs; environments where the HTTPS endpoint is down but HTTP is up.

Related errors

• insecure URL: %s
• tls: invalid server key share
• tls: invalid signature by the server certificate: {err}
• tls: invalid server finished hash
• https fetch: %v

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/19bd5ad2abbbe7e4. Report an issue: GitHub.