ory/hydra · error

http(s) loader disabled

Error message

http(s) loader disabled

What it means

When the source URL uses http or https, readFile checks the o.disableHTTPLoader option before performing the request via o.hc.Get. If remote HTTP loading is disabled, it returns errors.New("http(s) loader disabled"). This guard lets callers restrict readers to specific source types (e.g. local files only) and rejects any remote fetch attempt.

Source

Thrown at oryx/osx/file.go:177

		//#nosec G304 -- false positive
		bytes, err = os.ReadFile(source)
		if err != nil {
			return nil, errors.Wrap(err, "unable to read the file")
		}
	case "file":
		if o.disableFileLoader {
			return nil, errors.New("file loader disabled")
		}

		//#nosec G304 -- false positive
		bytes, err = os.ReadFile(parsed.Host + parsed.Path)
		if err != nil {
			return nil, errors.Wrap(err, "unable to read the file")
		}
	case "http", "https":
		if o.disableHTTPLoader {
			return nil, errors.New("http(s) loader disabled")
		}
		resp, err := o.hc.Get(parsed.String())
		if err != nil {
			return nil, errors.Wrap(err, "unable to load remote file")
		}
		defer resp.Body.Close()

		bytes, err = io.ReadAll(resp.Body)
		if err != nil {
			return nil, errors.Wrap(err, "unable to read the HTTP response body")
		}
	case "base64":
		if o.disableBase64Loader {
			return nil, errors.New("base64 loader disabled")
		}

		if o.disableResilientBase64Loader {
			bytes, err = o.base64enc.DecodeString(strings.TrimPrefix(source, "base64://"))

View on GitHub (pinned to 4174065ffb)

Solutions

1. Construct the Options without disabling the HTTP loader if remote URLs are acceptable in your environment
2. Change the source to a file path or file:// URL if the file loader is enabled and the content exists locally
3. Serve the content from a scheme that is enabled, or embed/vendor the file into the deployment
4. If the restriction is intentional (SSRF hardening), fetch the document out-of-band and pass its bytes instead of a URL

Example fix

// before
// opts has DisableHTTPLoader(true)
data, err := osx.RestrictedReadFile("https://example.com/schema.json") // error
// after
opts.DisableHTTPLoader(false) // or download first:
data, err := osx.RestrictedReadFile("./schema.json")

func isRemoteURL(source string) bool {
	u, err := url.Parse(source)
	return err == nil && (u.Scheme == "http" || u.Scheme == "https")
}

data, err := osx.RestrictedReadFile(source)
if err != nil {
	if err.Error() == "http(s) loader disabled" {
		// use a local mirror or re-enable the HTTP loader
	}
	return err
}

When it happens

Trigger: Calling RestrictedReadFile or ReadFileFromAllSources with an http:// or https:// URL while the Options were constructed with the disable-HTTP-loader option set (DisableHTTPLoader(true) or equivalent).

Common situations: Air-gapped or SSRF-hardened deployments that disable remote fetching, but a template/config still references a remote URL; migrating configs from hosted URLs to local files and forgetting the reverse case where a remote ref is required.

Related errors

• file loader disabled
• cookiex: purpose must be non-empty and must not contain a pi
• cookiex: at least one secret is required
• plan must define a DefaultPageToken
• the provided region is not a valid Ory region

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/ad11872d9ee6b11a. Report an issue: GitHub.