makeplane/plane · error · ValidationError

Invalid schema. Only HTTP and HTTPS are allowed.

Error message

Invalid schema. Only HTTP and HTTPS are allowed.

What it means

Django ValidationError raised by `validate_schema` (webhook.py:18) when `urlparse(value).scheme` is not `http` or `https`. It is one of two validators attached to `Webhook.url` (a URLField). It blocks any non-web scheme such as ftp, file, gopher, or javascript.

Source

Thrown at apps/api/plane/db/models/webhook.py:24

from uuid import uuid4
from urllib.parse import urlparse

# Django imports
from django.db import models
from django.core.exceptions import ValidationError

# Module imports
from plane.db.models import BaseModel, ProjectBaseModel


def generate_token():
    return "plane_wh_" + uuid4().hex


def validate_schema(value):
    parsed_url = urlparse(value)
    if parsed_url.scheme not in ["http", "https"]:
        raise ValidationError("Invalid schema. Only HTTP and HTTPS are allowed.")


def validate_domain(value):
    parsed_url = urlparse(value)
    domain = parsed_url.netloc
    if domain in ["localhost", "127.0.0.1"]:
        raise ValidationError("Local URLs are not allowed.")


class Webhook(BaseModel):
    workspace = models.ForeignKey("db.Workspace", on_delete=models.CASCADE, related_name="workspace_webhooks")
    url = models.URLField(validators=[validate_schema, validate_domain], max_length=1024)
    is_active = models.BooleanField(default=True)
    secret_key = models.CharField(max_length=255, default=generate_token)
    project = models.BooleanField(default=False)
    issue = models.BooleanField(default=False)
    module = models.BooleanField(default=False)
    cycle = models.BooleanField(default=False)

View on GitHub (pinned to 1c8a60f858)

Solutions

1. Supply a fully-qualified `http://` or `https://` URL for the webhook target.
2. Normalize on the client by prefixing `https://` when the user omits a scheme before submitting.
3. If a non-web protocol is genuinely needed, you must change `validate_schema` - it cannot be satisfied otherwise.
4. Validate the parsed scheme client-side before POSTing to the webhook create/update API.

Example fix

// before
url: "webhooks.example.com/hook"

// after
url: "https://webhooks.example.com/hook"

from urllib.parse import urlparse

def is_valid_webhook_scheme(url: str) -> bool:
    # mirrors webhook.py:20 validate_schema
    return urlparse(url).scheme in ('http', 'https')

When it happens

Trigger: Creating or updating a Webhook whose `url` uses a scheme other than http/https (e.g. `ftp://host`, `file:///etc/passwd`, `gopher://`, or a schemeless/malformed URL that urlparse cannot parse to http/https).

Common situations: User pastes a webhook target missing the `https://` prefix; integrating with an internal service exposed only via a non-http protocol; typos like `htp://`; testing SSRF payloads against the webhook endpoint.

Related errors

• Local URLs are not allowed.
• Invalid URL provided
• Invalid URL format
• Missing required fields.
• Invalid file type. Please select an image.

AI-assisted analysis of makeplane/plane@1c8a60f858 (2026-08-12). Data as JSON: /api/errors/d381b90d9dd6dc52. Report an issue: GitHub.