grafana/k6 · error

origin (%s) not allowed to load local file: %s

Error message

origin (%s) not allowed to load local file: %s

What it means

A security guard in Resolve. It fires when a script that was itself loaded from an https:// origin tries to import a file:// (local disk) module. This prevents remote code from reading arbitrary local files. The at-fault input is the file:// import made from an https origin.

Source

Thrown at internal/loader/loader.go:68

		return nil, errors.New("local or remote path required")
	}

	if moduleSpecifier[0] == '.' || moduleSpecifier[0] == '/' || filepath.IsAbs(moduleSpecifier) {
		return resolveFilePath(pwd, moduleSpecifier)
	}

	if strings.Contains(moduleSpecifier, "://") {
		u, err := url.Parse(moduleSpecifier)
		if err != nil {
			return nil, err
		}
		if u.Scheme != "file" && u.Scheme != "https" {
			return nil,
				fmt.Errorf("only supported schemes for imports are file and https, %s has `%s`",
					moduleSpecifier, u.Scheme)
		}
		if u.Scheme == "file" && pwd.Scheme == "https" {
			return nil, fmt.Errorf("origin (%s) not allowed to load local file: %s", pwd, moduleSpecifier)
		}
		return u, err
	}

	if strings.HasPrefix(moduleSpecifier, "cdnjs.com") {
		return nil, fmt.Errorf("cdnjs.com 'special' urls are no longer supported - please use real ones. " +
			"You can get yours by going to cdnjs and copy-pasting the full url to the actual JavaScript file")
	}
	if strings.HasPrefix(moduleSpecifier, "github.com") {
		return nil, fmt.Errorf("github.com 'special' urls are no longer supported - please use real ones. " +
			"You can get yours by going to github and copy-pasting the full url to the actual raw JavaScript file")
	}
	return nil, unresolvableURLError(moduleSpecifier)
}

func resolveFilePath(pwd *url.URL, moduleSpecifier string) (*url.URL, error) {
	if pwd.Opaque != "" { // this is a loader reference
		base, dir, _ := strings.Cut(pwd.Opaque, "/")

View on GitHub (pinned to 01ffac6f24)

Solutions

1. Serve the required module over https and import it by its remote URL
2. Load the top-level script locally instead of from https so relative local imports are allowed
3. Copy the module next to the local script and import it with a relative path

When it happens

Trigger: Thrown at internal/loader/loader.go:68 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of grafana/k6@01ffac6f24 (2026-08-18). Data as JSON: /api/errors/ca1da2a25b6f8bab. Report an issue: GitHub.