microsoft/semantic-kernel · error · KernelException

The URI scheme ' ' is not allowed for the ' ' gRPC…

Error message

The URI scheme '{addressUri.Scheme}' is not allowed for the '{operation.Name}' gRPC operation. Allowed schemes: {string.Join(", ", this._allowedSchemes)}.

What it means

Thrown when the parsed URI's scheme is not in the configured `_allowedSchemes` allow-list (case-insensitive). This is a security control: it prevents the gRPC runner from connecting via unexpected schemes (e.g. file://, ftp://) that could be smuggled via a malicious address.

Solutions

  1. Match the address scheme to the allowed set (prefer https).
  2. If http is intentional and trusted, add it to AllowedSchemes in GrpcOperationRunnerOptions.
  3. Double-check the address override URI scheme.

Example fix

// before
// address = http://service, allowedSchemes = [https]
// after
address = "https://service";
// or, only if http is explicitly trusted:
options.AllowedSchemes = new[] { "http", "https" };
Defensive patterns

Strategy: validation

Validate before calling

var allowed = new[] { "https" };
if (Uri.TryCreate(address, UriKind.Absolute, out var u) && !allowed.Contains(u.Scheme))
    throw new InvalidOperationException($"Scheme {u.Scheme} not allowed.");

Prevention

When it happens

Trigger: Address uses a scheme not in the allowed set — commonly the allow-list contains only `https` (or `http`/`https`) and the address is `http://` in a production-locked config, or vice-versa.

Common situations: Local dev uses plain http but the runner was configured to allow only https; a misconfigured address override carrying the wrong scheme.

Related errors

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/6c9cc1db2fb1a577. Report an issue: GitHub.

Appendix: source

Thrown at dotnet/src/Functions/Functions.Grpc/GrpcOperationRunner.cs:185

        else
        {
            address = operation.Address;
        }

        if (string.IsNullOrEmpty(address))
        {
            throw new KernelException($"No address provided for the '{operation.Name}' gRPC operation.");
        }

        if (!Uri.TryCreate(address, UriKind.Absolute, out var addressUri))
        {
            throw new KernelException($"The address '{address}' for the '{operation.Name}' gRPC operation is not a valid absolute URI.");
        }

        // Validate scheme
        if (!this._allowedSchemes.Contains(addressUri.Scheme, StringComparer.OrdinalIgnoreCase))
        {
            throw new KernelException($"The URI scheme '{addressUri.Scheme}' is not allowed for the '{operation.Name}' gRPC operation. Allowed schemes: {string.Join(", ", this._allowedSchemes)}.");
        }

        // Validate against allowed addresses
        if (this._allowedAddresses is { Count: > 0 })
        {
            bool isAllowed = false;
            foreach (var allowedAddress in this._allowedAddresses)
            {
                string allowedUri = allowedAddress.AbsoluteUri;

                if (addressUri.AbsoluteUri.StartsWith(allowedUri, StringComparison.OrdinalIgnoreCase))
                {
                    // If the allowed URI already ends at a boundary (e.g., trailing '/'),
                    // or the full URIs match exactly, no further check is needed.
                    // Otherwise, ensure the next character is a path boundary to prevent
                    // prefix bypasses (e.g., allowed "https://host/grpc" should not match "https://host/grpcevil").
                    int prefixLength = allowedUri.Length;
                    if (prefixLength >= addressUri.AbsoluteUri.Length ||

View on GitHub (pinned to c028a0c7dc)