santifer/career-ops · warning · Error

echojobs: URL must use HTTPS: ${url}

Error message

echojobs: URL must use HTTPS: ${url}

What it means

Thrown by echojobs' assertEchojobsUrl when the URL parses but its protocol is not https. Defense-in-depth: fetch() builds the URL from FEED_BASE ('https://...'), so the protocol is always https and this branch is unreachable through normal use. Reachable only via a direct assertEchojobsUrl call on an http URL.

Source

Thrown at providers/echojobs.mjs:30

// fetch is host-locked. The url is display-only and never server-fetched here.
//
// Wire in via a `job_boards:` entry with `provider: echojobs`.

const FEED_BASE = 'https://echojobs.io/api/jobs';
const TRUSTED_HOST = 'echojobs.io';
const PER_PAGE = 100;
const DEFAULT_MAX_PAGES = 3;
const MAX_PAGES_CAP = 50;

/** @param {string} url */
function assertEchojobsUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`echojobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`echojobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`echojobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */
function resolveMaxPages(entry) {
  const v = entry?.max_pages;
  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);
  return DEFAULT_MAX_PAGES;
}

// Guards against a doubled marker when the board already spells the work model
// into the location itself ("Berlin (Hybrid)", "Hybrid - London").
const HYBRID_MARKER = /\bhybrid\b/i;

/**

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. For direct callers, pass only https URLs.
2. For normal fetch() use, no action — the constant is https.
3. Investigate if seen in production: FEED_BASE was changed or the URL is no longer constant-derived.

Example fix

// before
assertEchojobsUrl('http://echojobs.io/api/jobs?page=1');

// after
assertEchojobsUrl('https://echojobs.io/api/jobs?page=1');

function isHttpsUrl(u) { try { return new URL(u).protocol === 'https:'; } catch { return false; } }

function isHttpsUrl(u) {
  if (typeof u !== 'string' || !u) return false;
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}

try { assertEchojobsUrl(url); }
catch (e) {
  if (/^echojobs: URL must use HTTPS/.test(e.message)) { /* upgrade to https or skip */ }
  else throw e;
}

When it happens

Trigger: assertEchojobsUrl is called directly with a well-formed http:// URL. No entry config or fetch() path produces this, since FEED_BASE is an https constant.

Common situations: A direct integration or test passing an http URL to the guard. Production scans cannot reach this branch.

Related errors

• comeet: URL must use HTTPS: ${redactToken(url)}
• echojobs: invalid URL: ${url}
• echojobs: untrusted hostname "${parsed.hostname}" — must be
• eightfold: URL must use HTTPS: ${url}
• flowxtra: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/cb66b454c6c1cb4d. Report an issue: GitHub.