santifer/career-ops · warning · Error

flowxtra: URL must use HTTPS: ${url}

Error message

flowxtra: URL must use HTTPS: ${url}

What it means

Thrown by flowxtra's assertFlowxtraEndpointUrl when the URL parses but is not https. Defense-in-depth: fetch() builds the URL from JOBS_ENDPOINT ('https://...'), so the protocol is always https and this branch is unreachable through normal use. Reachable only via a direct assertFlowxtraEndpointUrl call on an http URL.

Source

Thrown at providers/flowxtra.mjs:33

//
// Wire in via a `job_boards:` entry with `provider: flowxtra`.

const JOBS_ENDPOINT = 'https://app.flowxtra.com/api/central/jobs';
const TRUSTED_ENDPOINT_HOST = 'app.flowxtra.com';
const TRUSTED_APPLY_HOST = 'flowxtra.com';
const PER_PAGE = 100;
const DEFAULT_MAX_PAGES = 3;
const MAX_PAGES_CAP = 50;

/** @param {string} url */
function assertFlowxtraEndpointUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`flowxtra: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`flowxtra: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_ENDPOINT_HOST) {
    throw new Error(`flowxtra: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_ENDPOINT_HOST}`);
  }
  return url;
}

/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */
function resolveMaxPages(entry) {
  const v = entry?.max_pages;
  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);
  return DEFAULT_MAX_PAGES;
}

// NaN-safe Date.parse — `|| undefined` would also coerce a valid epoch 0.
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. For direct callers, pass only https URLs.
2. For normal fetch() use, no action — JOBS_ENDPOINT is https.
3. Investigate if seen in production: JOBS_ENDPOINT was changed.

Example fix

// before
assertFlowxtraEndpointUrl('http://app.flowxtra.com/api/central/jobs?page=1');

// after
assertFlowxtraEndpointUrl('https://app.flowxtra.com/api/central/jobs?page=1');

function isHttpsUrl(u) { try { return new URL(u).protocol === 'https:'; } catch { return false; } }

function isHttpsUrl(u) {
  if (typeof u !== 'string' || !u) return false;
  try { return new URL(u).protocol === 'https:'; } catch { return false; }
}

try { assertFlowxtraEndpointUrl(url); }
catch (e) {
  if (/^flowxtra: URL must use HTTPS/.test(e.message)) { /* upgrade to https or skip */ }
  else throw e;
}

When it happens

Trigger: assertFlowxtraEndpointUrl is called directly with a well-formed http:// URL. No entry config or fetch() path produces this.

Common situations: A direct integration or test passing an http URL to the guard. Production scans cannot reach this branch.

Related errors

• comeet: URL must use HTTPS: ${redactToken(url)}
• echojobs: URL must use HTTPS: ${url}
• eightfold: URL must use HTTPS: ${url}
• flowxtra: invalid URL: ${url}
• himalayas: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/3dd2853273bfb456. Report an issue: GitHub.