larksuite/cli · error

only https URLs are supported

Error message

only https URLs are supported

What it means

Unless AllowHTTP is enabled, the CheckRedirect policy in NewDownloadHTTPClient requires every redirect target to use https (internal/validate/url.go:153). A redirect to any non-https scheme (http, ftp, file, etc.) aborts the redirect chain with this error. It enforces the download security posture that untrusted downloads travel over TLS.

Source

Thrown at internal/validate/url.go:153

	}

	cloned := *base
	cloned.Transport = &downloadSchemeTransport{
		base:      cloneDownloadTransport(base.Transport),
		allowHTTP: opts.AllowHTTP,
	}
	cloned.CheckRedirect = func(req *http.Request, via []*http.Request) error {
		if len(via) >= opts.MaxRedirects {
			return fmt.Errorf("too many redirects")
		}
		if len(via) > 0 {
			prev := via[len(via)-1]
			if strings.EqualFold(prev.URL.Scheme, "https") && strings.EqualFold(req.URL.Scheme, "http") {
				return fmt.Errorf("redirect from https to http is not allowed")
			}
		}
		if !opts.AllowHTTP && !strings.EqualFold(req.URL.Scheme, "https") {
			return fmt.Errorf("only https URLs are supported")
		}
		if err := ValidateDownloadSourceURL(req.Context(), req.URL.String()); err != nil {
			return fmt.Errorf("blocked redirect target: %w", err)
		}
		return nil
	}

	return &cloned
}

type downloadSchemeTransport struct {
	base      http.RoundTripper
	allowHTTP bool
}

func (t *downloadSchemeTransport) RoundTrip(req *http.Request) (*http.Response, error) {
	if req == nil || req.URL == nil {
		return nil, errs.NewInternalError(

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Redirect to or start from an https:// URL; update the source URL or server config.
2. If plain http is intentionally required, construct the client with DownloadHTTPClientOptions{AllowHTTP: true}.
3. For non-http/https schemes (ftp, file), the download path is unsupported — use an appropriate tool instead.

Example fix

// before
client := validate.NewDownloadHTTPClient(base, validate.DownloadHTTPClientOptions{})
// after: explicitly permit plain http when needed
client := validate.NewDownloadHTTPClient(base, validate.DownloadHTTPClientOptions{AllowHTTP: true})

u, err := url.Parse(src)
if err != nil || u.Scheme != "https" {
    return fmt.Errorf("download source must be https, got %v", u)
}

resp, err := client.Get(url)
if err != nil {
    if strings.Contains(err.Error(), "only https URLs are supported") {
        // either switch to an https source or rebuild client with AllowHTTP: true
        return fmt.Errorf("non-https redirect rejected: %w", err)
    }
    return err
}

When it happens

Trigger: A 3xx response whose Location header is an http:// URL (or another non-https scheme) while following redirects on a download client built with AllowHTTP unset/false.

Common situations: Servers redirecting to a plaintext mirror or CDN endpoint; corporate infra where internal links are http; tests hitting a local plain-http endpoint from an https start URL.

Related errors

• redirect from https to http is not allowed
• official skills index redirected to non-HTTPS URL: %s
• too many redirects
• blocked redirect target: %w
• app registration failed: HTTP %d – response not JSON

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/f3e901ea8ada1a15. Report an issue: GitHub.