santifer/career-ops · error · Error

justjoin: URL must use HTTPS: ${url}

Error message

justjoin: URL must use HTTPS: ${url}

What it means

Thrown by assertJustJoinUrl() when the URL parses but its protocol is not https:. The justjoin.it provider pins all requests to HTTPS as an SSRF guard; an http:// URL (or any other scheme) is rejected before any network call. The check runs on both the configured api/careers_url and any URL built by buildApiUrl().

Source

Thrown at providers/justjoin.mjs:21

// JustJoin.it provider — hits the current candidate offers API.
// Browser URLs under https://justjoin.it/job-offers/... are accepted for
// detection, but fetches use https://justjoin.it/api/candidate-api/offers.

const ALLOWED_HOSTS = new Set(['justjoin.it']);
const API_BASE = 'https://justjoin.it/api/candidate-api/offers';
const JOB_BASE = 'https://justjoin.it/job-offer/';
const PAGE_SIZE = 100;
const MAX_PAGES = 50;

function assertJustJoinUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`justjoin: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`justjoin: URL must use HTTPS: ${url}`);
  if (!ALLOWED_HOSTS.has(parsed.hostname)) {
    throw new Error(`justjoin: untrusted hostname "${parsed.hostname}" — must be justjoin.it`);
  }
  if (!parsed.pathname.startsWith('/job-offers') && parsed.pathname !== '/api/candidate-api/offers') {
    throw new Error(`justjoin: URL path must be /job-offers or /api/candidate-api/offers: ${url}`);
  }
  return parsed;
}

function detectUrl(entry) {
  const url = entry.api || entry.careers_url || '';
  if (typeof url !== 'string' || !url.trim()) return null;
  try {
    const parsed = assertJustJoinUrl(url);
    return { url: parsed.href };
  } catch {
    return null;
  }

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Change the protocol in the api/careers_url field to https://.
2. Re-run the scan to confirm the guard no longer trips.

Example fix

# before
acme:
  provider: justjoin
  api: http://justjoin.it/api/candidate-api/offers

# after
acme:
  provider: justjoin
  api: https://justjoin.it/api/candidate-api/offers

function isHttps(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}

/** @param {string} url @returns {boolean} */
function isHttpsUrl(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}

When it happens

Trigger: An api or careers_url entry using http:// instead of https://; a constructed URL that inherited a non-https scheme from user input.

Common situations: A legacy or hand-edited entry that used http; a copy-paste from a source that stripped the scheme to http.

Related errors

• justjoin: invalid URL: ${url}
• flowxtra: untrusted hostname "${parsed.hostname}" — must be
• gem: invalid URL: ${url}
• gem: URL must use HTTPS: ${url}
• gem: untrusted hostname "${parsed.hostname}" — must be one o

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/bf0b7fd41d02cc3b. Report an issue: GitHub.