santifer/career-ops · warning · Error

eightfold: URL must use HTTPS: ${url}

Error message

eightfold: URL must use HTTPS: ${url}

What it means

Thrown by eightfold's assertEightfoldUrl when the URL parses but is not https. Defense-in-depth: buildApiUrl always constructs the URL with a literal 'https://' prefix, so the protocol is always https and this branch is unreachable through normal fetch() use. Reachable only via a direct assertEightfoldUrl call on an http URL.

Source

Thrown at providers/eightfold.mjs:71

// Eightfold's edge rate-limits bursts, and a 616-job board is 62 requests.
const INTER_PAGE_DELAY_MS = 150;

const RETRY_POLICY = { retries: 3, baseDelayMs: 500, maxDelayMs: 8_000 };

/**
 * SSRF guard — every request URL passes through here before it is fetched.
 *
 * @param {string} url
 * @returns {string} the same URL, when it is a trusted Eightfold endpoint.
 */
function assertEightfoldUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`eightfold: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`eightfold: URL must use HTTPS: ${url}`);
  if (!EIGHTFOLD_HOST_RE.test(parsed.hostname)) {
    throw new Error(`eightfold: untrusted hostname "${parsed.hostname}" — must match *.eightfold.ai`);
  }
  return url;
}

/** @param {number} ms @param {any} ctx */
function sleep(ms, ctx) {
  if (typeof ctx?.sleep === 'function') return ctx.sleep(ms);
  return new Promise((resolve) => setTimeout(resolve, ms));
}

/**
 * Eightfold reports timestamps as epoch SECONDS (`t_create`, `t_update`), not
 * the ISO strings every other provider gets. Converted here; anything
 * non-finite or non-positive is dropped rather than guessed at.
 *
 * @param {unknown} value

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. For direct callers, pass only https URLs.
2. For normal fetch() use, no action — buildApiUrl hard-codes https.
3. Investigate if seen in production: buildApiUrl was changed.

Example fix

// before
assertEightfoldUrl('http://bayer.eightfold.ai/api/apply/v2/jobs?start=0&num=10');

// after
assertEightfoldUrl('https://bayer.eightfold.ai/api/apply/v2/jobs?start=0&num=10');

function isHttpsUrl(u) { try { return new URL(u).protocol === 'https:'; } catch { return false; } }

function isHttpsUrl(u) {
  if (typeof u !== 'string' || !u) return false;
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}

try { assertEightfoldUrl(url); }
catch (e) {
  if (/^eightfold: URL must use HTTPS/.test(e.message)) { /* upgrade to https or skip */ }
  else throw e;
}

When it happens

Trigger: assertEightfoldUrl is called directly with a well-formed http:// URL. No entry config or fetch() path produces this.

Common situations: A direct integration or test passing an http URL to the guard. Production scans cannot reach this branch.

Related errors

• comeet: URL must use HTTPS: ${redactToken(url)}
• echojobs: URL must use HTTPS: ${url}
• eightfold: invalid URL: ${url}
• eightfold: untrusted hostname "${parsed.hostname}" — must ma
• flowxtra: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/423b84803f4f258e. Report an issue: GitHub.