santifer/career-ops · error · Error

jobstreet: URL must use HTTPS: ${url}

Error message

jobstreet: URL must use HTTPS: ${url}

What it means

Thrown by assertJobstreetUrl when entry.api parses but its protocol is not https:. The assert runs against entry.api || DEFAULT_API, so this is reachable whenever a user sets api: to an http:// URL.

Source

Thrown at providers/jobstreet.mjs:58

  'my.jobstreet.com',
  'www.seek.com.au',
  'www.seek.co.nz',
]);

// v5 API paths (the client-side JS on jobstreet uses these relative paths
// resolved against the current origin). We keep the allowlist for SSRF
// protection on the base URL, then build the v5 search path from it.
const V5_SEARCH_PATH = '/api/jobsearch/v5/search';

/** @param {string} url */
function assertJobstreetUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`jobstreet: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`jobstreet: URL must use HTTPS: ${url}`);
  if (!ALLOWED_JOBSTREET_HOSTS.has(parsed.hostname))
    throw new Error(`jobstreet: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_JOBSTREET_HOSTS].join(', ')}`);
  return url;
}

/**
 * Derive the origin from the API hostname.
 * e.g. id.jobstreet.com → https://id.jobstreet.com
 * @param {string} apiUrl
 * @returns {string}
 */
function deriveOrigin(apiUrl) {
  try {
    const parsed = new URL(apiUrl);
    return `${parsed.protocol}//${parsed.hostname}`;
  } catch {
    return 'https://id.jobstreet.com';
  }

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Set api: to the https:// form of the endpoint.
2. If the regional endpoint you need is genuinely http-only (unusual for Jobstreet), that is unsupported — use an https mirror or omit api:.
3. Add a config lint that flags non-https api: values across all providers.

Example fix

# before
- name: Jobstreet ID
  provider: jobstreet
  api: http://id.jobstreet.com/api/jobsearch/v5/search

# after
- name: Jobstreet ID
  provider: jobstreet
  api: https://id.jobstreet.com/api/jobsearch/v5/search

if (typeof entry.api === 'string') {
  const u = new URL(entry.api); // throws on malformed — see error 216
  if (u.protocol !== 'https:') {
    throw new Error(`jobstreet: entry.api must use https: ${entry.api}`);
  }
}

/** True only for an https: absolute URL. */
function isHttpsUrl(value) {
  try { return new URL(value).protocol === 'https:'; } catch { return false; }
}

try {
  return await jobstreetProvider.fetch(entry, ctx);
} catch (err) {
  if (/URL must use HTTPS/.test(err.message)) {
    console.error(`config: ${entry.name} — ${err.message}`);
  } else {
    throw err;
  }
}

When it happens

Trigger: A portal entry with provider: jobstreet and api: set to an http:// URL (e.g. a captured request or a regional mirror without TLS). DEFAULT_API is https so omitting api: never triggers this.

Common situations: Copying an http URL from a tool that downgraded the scheme; pointing at an internal/http-only proxy mirror during development; a typo dropping the 's' in https://.

Related errors

• jobstreet: invalid URL: ${url}
• jobstreet: untrusted hostname "${parsed.hostname}" — must be
• arbeitnow: invalid URL: ${url}
• ashby: invalid URL: ${url}
• bamboohr: invalid URL: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/5cb62aa1bcde2be3. Report an issue: GitHub.