googleapis/mcp-toolbox · error

URL scheme must be https, got %q

Error message

URL scheme must be https, got %q

What it means

After parsing, validateFHIRPageURL enforces that the pagination URL uses the https scheme. Any http:// (or other scheme) page URL is rejected to prevent SSRF and credential leakage over plaintext. The %q shows the offending scheme found in the URL.

Source

Thrown at internal/sources/cloudhealthcare/cloud_healthcare.go:331

	if v[1] < '1' || v[1] > '9' {
		return false
	}
	for i := 2; i < len(v); i++ {
		if !isAlphanumeric(v[i]) {
			return false
		}
	}
	return true
}

func (s *Source) validateFHIRPageURL(pageURL string) (string, error) {
	parsed, err := url.Parse(pageURL)
	if err != nil {
		return "", fmt.Errorf("invalid page URL: %w", err)
	}

	if parsed.Scheme != "https" {
		return "", fmt.Errorf("URL scheme must be https, got %q", parsed.Scheme)
	}

	parsed.Host = strings.ToLower(parsed.Host)
	host := parsed.Host
	if h, _, err := net.SplitHostPort(host); err == nil {
		host = h
	}
	if _, ok := allowedFHIRHosts[host]; !ok {
		return "", fmt.Errorf("URL host must be an allowed FHIR host, got %q", host)
	}

	// Clean and split path
	cleanPath := path.Clean(parsed.Path)
	// Truncate leading and trailing slashes for easier splitting
	trimmed := strings.Trim(cleanPath, "/")
	parts := strings.Split(trimmed, "/")

	// Page URL format Reference: https://docs.cloud.google.com/healthcare-api/docs/how-tos/fhir-search#using_the_search_method_with_get

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Always use the exact https page URL from the prior response's links.next
2. If a local test endpoint is needed, extend allowedFHIRHosts/scheme logic in a dev build rather than downgrading the scheme
3. Use https proxies (CONNECT) instead of rewriting to http
4. If you must test, run the validation with a test-only allowlist that permits http for localhost

Example fix

// before
page := "http://healthcare.googleapis.com/v1/projects/.../fhir/Patient?pageToken=x"
// after
page := "https://healthcare.googleapis.com/v1/projects/.../fhir/Patient?pageToken=x"

function ensureHttps(u) { const p = new URL(u); if (p.protocol !== 'https:') throw new Error(`page URL must be https, got ${p.protocol}`); return p; }

When it happens

Trigger: A caller supplies a page URL rewritten to http://healthcare.googleapis.com/... (downgraded by a proxy, manually edited, or reconstructed by an LLM from text), or a scheme-less string that parses with an unexpected scheme value.

Common situations: Reverse proxies configured with http backends rewriting Location headers; tests hitting local http mock servers against production validation; copy-pasting a link that had https stripped by a chat client or document.

Related errors

• URL host must be an allowed FHIR host, got %q
• path must be relative and cannot override base host
• redirect to blocked IP %s denied
• redirect host %s resolves to blocked IP %s
• path cannot contain dot segments (..)

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/cbe3a873d88cea18. Report an issue: GitHub.