larksuite/cli · error

redirect from https to http is not allowed

Error message

redirect from https to http is not allowed

What it means

The CheckRedirect policy in NewDownloadHTTPClient rejects any redirect that downgrades from https to http. This is a deliberate security control (internal/validate/url.go:149): a TLS-protected source must not silently redirect to plaintext, which would allow interception or tampering of the download. The redirect is aborted and the error is returned from the http.Client call.

Source

Thrown at internal/validate/url.go:149

		base = &http.Client{}
	}
	if opts.MaxRedirects <= 0 {
		opts.MaxRedirects = defaultDownloadMaxRedirects
	}

	cloned := *base
	cloned.Transport = &downloadSchemeTransport{
		base:      cloneDownloadTransport(base.Transport),
		allowHTTP: opts.AllowHTTP,
	}
	cloned.CheckRedirect = func(req *http.Request, via []*http.Request) error {
		if len(via) >= opts.MaxRedirects {
			return fmt.Errorf("too many redirects")
		}
		if len(via) > 0 {
			prev := via[len(via)-1]
			if strings.EqualFold(prev.URL.Scheme, "https") && strings.EqualFold(req.URL.Scheme, "http") {
				return fmt.Errorf("redirect from https to http is not allowed")
			}
		}
		if !opts.AllowHTTP && !strings.EqualFold(req.URL.Scheme, "https") {
			return fmt.Errorf("only https URLs are supported")
		}
		if err := ValidateDownloadSourceURL(req.Context(), req.URL.String()); err != nil {
			return fmt.Errorf("blocked redirect target: %w", err)
		}
		return nil
	}

	return &cloned
}

type downloadSchemeTransport struct {
	base      http.RoundTripper
	allowHTTP bool
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Use an https:// target URL that does not redirect to http; ask the source owner to fix the redirect.
2. If plaintext is genuinely acceptable (e.g. tests), set AllowHTTP: true — note this only permits http generally, the https->http downgrade is still blocked, so you must start from an http URL instead.
3. Fetch the final http URL directly with an explicitly http (AllowHTTP) client rather than following the downgrade redirect.

Example fix

// before: starts at https but server redirects to http mirror
resp, err := client.Get("https://example.com/file.bin")
// after: go straight to the plaintext mirror only if allowed
client := validate.NewDownloadHTTPClient(base, validate.DownloadHTTPClientOptions{AllowHTTP: true})
resp, err := client.Get("http://mirror.example.com/file.bin")

u, err := url.Parse(src)
if err != nil || u.Scheme != "https" {
    return fmt.Errorf("download source must be https")
}
// Probe the URL's redirect chain and reject any http Location.

resp, err := client.Get(url)
if err != nil {
    if strings.Contains(err.Error(), "https to http") {
        return fmt.Errorf("source downgrades TLS; use a different mirror: %w", err)
    }
    return err
}

When it happens

Trigger: A download started from an https:// URL whose server responds with a 3xx pointing at an http:// URL, on a client built by NewDownloadHTTPClient.

Common situations: Legacy servers that redirect https to http mirrors; misconfigured hosting that serves http Location headers; testing against a local http server redirected from an https entry point.

Related errors

• only https URLs are supported
• official skills index redirected to non-HTTPS URL: %s
• too many redirects
• blocked redirect target: %w
• app registration failed: HTTP %d – response not JSON

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/81dafa98a82ff3a9. Report an issue: GitHub.