hashicorp/terraform · error

address must be HTTP or HTTPS

Error message

address must be HTTP or HTTPS

What it means

After parsing address, Configure() restricts the scheme to 'http' or 'https'. Any other scheme (ftp, file, ws, missing scheme so it parses as path) is rejected because the HTTP backend only speaks HTTP(S). A missing scheme often manifests as the parsed URL having Scheme == "" which fails this check.

Source

Thrown at internal/backend/remote-state/http/backend.go:138

func (b *Backend) Configure(configVal cty.Value) tfdiags.Diagnostics {
	address := backendbase.GetAttrEnvDefaultFallback(
		configVal, "address",
		"TF_HTTP_ADDRESS", cty.StringVal(""),
	).AsString()
	if address == "" {
		return backendbase.ErrorAsDiagnostics(
			fmt.Errorf("address argument is required"),
		)
	}
	updateURL, err := url.Parse(address)
	if err != nil {
		return backendbase.ErrorAsDiagnostics(
			fmt.Errorf("failed to parse address URL: %s", err),
		)
	}
	if updateURL.Scheme != "http" && updateURL.Scheme != "https" {
		return backendbase.ErrorAsDiagnostics(
			fmt.Errorf("address must be HTTP or HTTPS"),
		)
	}

	updateMethod := backendbase.GetAttrEnvDefaultFallback(
		configVal, "update_method",
		"TF_HTTP_UPDATE_METHOD", cty.StringVal("POST"),
	).AsString()

	var lockURL *url.URL
	if v := backendbase.GetAttrEnvDefault(configVal, "lock_address", "TF_HTTP_LOCK_ADDRESS"); !v.IsNull() {
		var err error
		lockURL, err = url.Parse(v.AsString())
		if err != nil {
			return backendbase.ErrorAsDiagnostics(
				fmt.Errorf("failed to parse lock_address URL: %s", err),
			)
		}
		if lockURL.Scheme != "http" && lockURL.Scheme != "https" {

View on GitHub (pinned to c9def3e214)

Solutions

1. Prefix the address with 'https://' (preferred) or 'http://' (insecure, not recommended).
2. Confirm there's no leading whitespace or stray character eating the scheme.
3. Use https for any real endpoint; reserve http for local testing only.

Example fix

// before
address = "state.example.com/?type=axios"   // no scheme

// after
address = "https://state.example.com/?type=axios"

import "net/url"
u, err := url.Parse(address)
if err != nil { log.Fatal(err) }
if u.Scheme != "http" && u.Scheme != "https" {
    log.Fatalf("address scheme must be http or https, got %q", u.Scheme)
}

func isHTTPScheme(s string) bool {
    u, err := url.Parse(s)
    return err == nil && (u.Scheme == "http" || u.Scheme == "https")
}

When it happens

Trigger: address is 'file:///path', 'ftp://host', or has no scheme like 'state.example.com/?type=axios' (parses as path with empty scheme). Triggered during 'terraform init'.

Common situations: User omitted the https:// prefix; copy-pasted a URL that lost its scheme; intentional use of a non-HTTP protocol by mistake.

Related errors

• lock_address must be HTTP or HTTPS
• address argument is required
• failed to parse address URL: %s
• failed to parse lock_address URL: %s
• failed to append certs

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/cb74b1cb2a77add1. Report an issue: GitHub.