santifer/career-ops · error · Error

jobvite: URL must use HTTPS: ${url}

Error message

jobvite: URL must use HTTPS: ${url}

What it means

Thrown by assertJobviteHost() when a Jobvite URL parses successfully but uses any protocol other than https: (e.g. http:, ftp:). This is a hard SSRF guard — the provider pins both the Jobvite board host and the XML feed host to HTTPS and refuses to fetch anything else, so an accidental or maliciously injected cleartext URL never reaches the network.

Source

Thrown at providers/jobvite.mjs:100

// 1.88 MB for 236 jobs in ~11s. That overshoots the shared 10s default in
// _http.mjs by a second, which aborted the whole tenant and reported it as a
// network failure. Sized to absorb a genuinely big tenant on a slow link; the
// board page (a normal HTML document) keeps the default.
const FEED_TIMEOUT_MS = 45_000;

/**
 * Pin a URL to the two known Jobvite hosts over HTTPS.
 * @param {string} url
 */
function assertJobviteHost(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`jobvite: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:')
    throw new Error(`jobvite: URL must use HTTPS: ${url}`);
  if (!ALLOWED_HOSTS.has(parsed.hostname))
    throw new Error(`jobvite: untrusted hostname "${parsed.hostname}" — must be ${BOARD_HOST} or ${FEED_HOST}`);
  return url;
}

// NaN-safe Date.parse → epoch ms.
/** @param {string} value */
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

/**
 * The vanity slug from a Jobvite careers URL, or null.
 * Only used to build the board URL for eId discovery.
 *
 * @param {import('./_types.js').PortalEntry} entry

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Edit the offending portals.yml entry and change the protocol to https:// (e.g. http://jobs.jobvite.com/acme → https://jobs.jobvite.com/acme).
2. If the error references a built URL (not your config), verify the entry's company_eid or api field is well-formed, since buildBoardFetchUrl/buildFeedUrl derive the host from constants and the only variable input is the slug/eid.
3. Re-run the scan to confirm the corrected entry no longer trips the guard.

Example fix

// before (portals.yml)
job_boards:
  acme:
    provider: jobvite
    careers_url: http://jobs.jobvite.com/acme

// after
job_boards:
  acme:
    provider: jobvite
    careers_url: https://jobs.jobvite.com/acme

function isHttpsUrl(url) {
  try {
    return new URL(url).protocol === 'https:';
  } catch {
    return false;
  }
}
// before passing entry.careers_url to the jobvite provider:
if (!isHttpsUrl(entry.careers_url)) {
  throw new Error(`config: ${entry.name} careers_url must be https://`);
}

/** @param {string} url @returns {boolean} */
function isJobviteHttpsUrl(url) {
  try {
    const p = new URL(url);
    return p.protocol === 'https:' && /(^|\.)jobvite\.com$/i.test(p.hostname);
  } catch {
    return false;
  }
}

When it happens

Trigger: A careers_url or api URL in a portals.yml job_boards entry that starts with http:// instead of https://; an entry edited by hand that dropped the scheme; or a malformed input where the protocol substring got mangled. The check runs inside assertJobviteHost(), which is called on every URL the provider builds (boardUrl, feedUrl) before any fetch.

Common situations: Copy-pasting a Jobvite careers URL from a browser that auto-stripped the scheme; a config file where a legacy entry predates the HTTPS-only policy; a redirect target that was constructed without upgrading the scheme.

Related errors

• flowxtra: untrusted hostname "${parsed.hostname}" — must be
• gem: invalid URL: ${url}
• gem: URL must use HTTPS: ${url}
• gem: untrusted hostname "${parsed.hostname}" — must be one o
• getonbrd: invalid URL: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/33e70187e11e8055. Report an issue: GitHub.