santifer/career-ops · error · Error

jobspresso: URL must use HTTPS: ${url}

Error message

jobspresso: URL must use HTTPS: ${url}

What it means

Thrown by assertJobspressoUrl when the URL parses but its protocol is not https:. The shipped fetch() only passes the hardcoded https FEED_URL constant, so this cannot fire from the public contract; it is an SSRF guard that activates if the constant is changed to http: or the assert is reused on http caller input.

Source

Thrown at providers/jobspresso.mjs:23

// (https://jobspresso.co/?feed=job_feed). The feed is public, no-auth,
// and XML, so it is parsed in-process with the same tiny tag extractor
// approach as providers/personio.mjs rather than adding an XML dependency.
//
// Wire in via a `job_boards:` entry with `provider: jobspresso`.

const FEED_URL = 'https://jobspresso.co/?feed=job_feed';
const TRUSTED_HOST = 'jobspresso.co';

/** @param {string} url */
function assertJobspressoUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`jobspresso: invalid URL: ${url}`);
  }
  if (parsed.protocol !== "https:")
    throw new Error(`jobspresso: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(
      `jobspresso: untrusted hostname "${parsed.hostname}" - must be ${TRUSTED_HOST}`,
    );
  }
  return url;
}

// NaN-safe Date.parse - `|| undefined` would also coerce a valid epoch 0.
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

/** @type {Provider} */
export default {
  id: "jobspresso",

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Ensure FEED_URL (or any URL passed in) uses the https: scheme.
2. If a dev mirror is http-only, gate the assert behind a test-only override rather than weakening the constant.
3. Keep the scheme and host checks reviewed together when changing endpoints.

Example fix

// before
const FEED_URL = 'http://jobspresso.co/?feed=job_feed';

// after
const FEED_URL = 'https://jobspresso.co/?feed=job_feed';

function ensureHttps(url) {
  const u = new URL(url);
  if (u.protocol !== 'https:') throw new Error(`not https: ${url}`);
  return u.href;
}

/** True only for an https: absolute URL. */
function isHttpsUrl(value) {
  try { return new URL(value).protocol === 'https:'; } catch { return false; }
}

try {
  return await jobspressoProvider.fetch(entry, ctx);
} catch (err) {
  if (/URL must use HTTPS/.test(err.message)) {
    console.error(`jobspresso: FEED_URL must be https — ${err.message}`);
  }
  throw err;
}

When it happens

Trigger: Editing FEED_URL to an http:// value (e.g. a dev mirror without TLS); reusing assertJobspressoUrl on entry-supplied input using http:. The unmodified provider's constant is https and never triggers this.

Common situations: Forgetting the https:// scheme when changing the feed host; pointing at a local dev mirror over plain http.

Related errors

• comeet: URL must use HTTPS: ${redactToken(url)}
• echojobs: URL must use HTTPS: ${url}
• eightfold: URL must use HTTPS: ${url}
• flowxtra: URL must use HTTPS: ${url}
• himalayas: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/827ca5e7a356d850. Report an issue: GitHub.