santifer/career-ops · error · Error

ashby: URL must use HTTPS: ${url}

Error message

ashby: URL must use HTTPS: ${url}

What it means

The HTTPS-enforcement step of ashby's SSRF guard. After the URL parses, any scheme other than `https:` is rejected. This blocks `http://` downgrade attacks and ensures transport security to the Ashby API.

Source

Thrown at providers/ashby.mjs:88

  const resolvedMax = /** @type {number} */ (max ?? min);
  return {
    min: Math.min(resolvedMin, resolvedMax),
    max: Math.max(resolvedMin, resolvedMax),
    currency: currency.toUpperCase(),
  };
}

const ALLOWED_ASHBY_HOSTS = new Set(['api.ashbyhq.com']);

/** @param {string} url */
function assertAshbyUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`ashby: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`ashby: URL must use HTTPS: ${url}`);
  if (!ALLOWED_ASHBY_HOSTS.has(parsed.hostname))
    throw new Error(`ashby: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_ASHBY_HOSTS].join(', ')}`);
  return url;
}

/** @param {import('./_types.js').PortalEntry} entry */
function resolveApiUrl(entry) {
  // Explicit api: wins — lets an entry keep a human-facing corporate
  // careers_url (e.g. https://openai.com/careers) while still pinning the
  // Ashby posting-api board (mirrors greenhouse's api: precedence).
  if (entry.api) {
    assertAshbyUrl(entry.api);
    return entry.api;
  }
  const url = entry.careers_url || '';
  const match = url.match(/jobs\.ashbyhq\.com\/([^/?#]+)/);
  if (!match) return null;
  return `https://api.ashbyhq.com/posting-api/job-board/${match[1]}?includeCompensation=true`;

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Use `https://api.ashbyhq.com/...` for the `api:` field.
2. Remove any http:// overrides from config or environment.
3. If testing through a local TLS proxy, terminate TLS on the proxy rather than disabling the check.

Example fix

# before
- name: Acme
  api: http://api.ashbyhq.com/posting-api?compId=acme

# after
- name: Acme
  api: https://api.ashbyhq.com/posting-api?compId=acme

function ensureHttpsApi(entry) {
  if (!entry.api) return;
  const p = new URL(entry.api);
  if (p.protocol !== 'https:') throw new Error(`ashby: api must be https: ${entry.api}`);
}
ensureHttpsApi(entry);

When it happens

Trigger: `parsed.protocol !== 'https:'` for a URL that otherwise parses. Commonly an `http://api.ashbyhq.com/...` value in `entry.api` or a derived URL.

Common situations: An `api:` config value copied from an insecure source, a local/dev proxy URL left in config, or a tool that stripped the scheme to http.

Related errors

• arbeitnow: URL must use HTTPS: ${url}
• ashby: invalid URL: ${url}
• bamboohr: URL must use HTTPS: ${url}
• breezy: URL must use HTTPS: ${url}
• Refusing non-HTTP(S) URL: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/0023ca7b811f9fe6. Report an issue: GitHub.