ruvnet/ruflo · error · HttpError

Invalid or unsafe URL (only HTTPS is supported)

Error message

Invalid or unsafe URL (only HTTPS is supported)

What it means

SvelteKit 400 error thrown by the fetch-url GET handler when the provided URL fails isValidUrl — the endpoint only permits HTTPS and blocks unsafe targets as an SSRF guard.

Source

Thrown at ruflo/src/ruvocal/src/routes/api/fetch-url/+server.ts:59

					}
				}
				return callback(null, address, family);
			});
		},
	},
});

export async function GET({ url }) {
	const targetUrl = url.searchParams.get("url");

	if (!targetUrl) {
		logger.warn("Missing 'url' parameter");
		throw error(400, "Missing 'url' parameter");
	}

	if (!isValidUrl(targetUrl)) {
		logger.warn({ targetUrl }, "Invalid or unsafe URL (only HTTPS is supported)");
		throw error(400, "Invalid or unsafe URL (only HTTPS is supported)");
	}

	// Fetch with timeout, following redirects manually to validate each hop
	const controller = new AbortController();
	const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT);

	let currentUrl = targetUrl;
	let response: Awaited<ReturnType<typeof fetch>>;
	let redirectCount = 0;

	try {
		// eslint-disable-next-line no-constant-condition
		while (true) {
			response = await fetch(currentUrl, {
				signal: controller.signal,
				redirect: "manual",
				dispatcher: ssrfSafeAgent,
				headers: {

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Provide a valid https:// URL pointing to a public host; private IPs, localhost, and non-HTTPS schemes are rejected by the SSRF guard.

When it happens

Trigger: Thrown at ruflo/src/ruvocal/src/routes/api/fetch-url/+server.ts:59 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/5316b013c7c6bd4f. Report an issue: GitHub.