iOfficeAI/AionUi · error · Error

update.errors.httpsOnly

update.errors.httpsOnly

Error message

update.errors.httpsOnly

What it means

Thrown by assertAllowedUrl when the URL parses successfully but its protocol is anything other than https:. The updater intentionally enforces HTTPS-only downloads to prevent MITM attacks on update artifacts.

Source

Thrown at packages/desktop/src/process/bridge/updateBridge.ts:279

  };
};

const resolveRepo = (requestRepo?: string): string => {
  const envRepo = process.env.AIONUI_GITHUB_REPO?.trim();
  const repo = (requestRepo || envRepo || DEFAULT_REPO).trim();
  return repo || DEFAULT_REPO;
};

const assertAllowedUrl = async (rawUrl: string) => {
  let parsed: URL;
  try {
    parsed = new URL(rawUrl);
  } catch {
    throw new Error((await getI18n()).t('update.errors.invalidUrl'));
  }

  if (parsed.protocol !== 'https:') {
    throw new Error((await getI18n()).t('update.errors.httpsOnly'));
  }
  if (!ALLOWED_DOWNLOAD_HOSTS.has(parsed.hostname)) {
    throw new Error((await getI18n()).t('update.errors.hostNotAllowed', { host: parsed.hostname }));
  }
};

const fetchWithAllowlistedRedirects = async (rawUrl: string, signal: AbortSignal): Promise<Response> => {
  let current = rawUrl;

  for (let i = 0; i <= MAX_REDIRECTS; i++) {
    await assertAllowedUrl(current);

    const res = await fetch(current, {
      signal,
      redirect: 'manual',
      headers: {
        'User-Agent': DEFAULT_USER_AGENT,
      },

View on GitHub (pinned to 711aa0550e)

Solutions

1. Switch the URL to https:// (install a cert / use HTTPS endpoint on the update server)
2. For local testing, use a self-signed cert with NODE_EXTRA_CA_CERTS rather than downgrading to http
3. Update the stored feed URL to its HTTPS equivalent
4. If you control the server, enable TLS (e.g. via a reverse proxy with Let's Encrypt)

Example fix

// before
await assertAllowedUrl('http://updates.example.com/app.json');

// after
await assertAllowedUrl('https://updates.example.com/app.json');

if (!/^https:\/\//i.test(feedUrl.trim())) {
  throw new Error('update URL must start with https://');
}
await initUpdateBridge(feedUrl.trim());

const isHttpsUrl = (s: string): boolean => {
  try { return new URL(s).protocol === 'https:'; } catch { return false; }
};

try {
  await assertAllowedUrl(url);
} catch (err) {
  if (err instanceof Error && err.message.includes('httpsOnly')) {
    url = url.replace(/^http:/, 'https:'); // then retry
  } else throw err;
}

When it happens

Trigger: Passing an http:// URL to any update fetch path guarded by assertAllowedUrl. Also fires for file://, ftp://, or other schemes — only exactly 'https:' is accepted.

Common situations: Local development against a test update server over http://; an old config created before HTTPS was enforced; a company-internal mirror that only serves http; copy-pasting a URL from docs that used http.

Related errors

• update.errors.invalidUrl
• update.errors.hostNotAllowed
• update.errors.redirectNoLocation
• update.errors.tooManyRedirects
• update.errors.githubApiFailed

AI-assisted analysis of iOfficeAI/AionUi@711aa0550e (2026-08-28). Data as JSON: /api/errors/fe03fb11e4752b3a. Report an issue: GitHub.