santifer/career-ops · error · Error

landingjobs: URL must use HTTPS

Error message

landingjobs: URL must use HTTPS: ${url}

What it means

assertLandingUrl enforces an HTTPS-only policy: after successfully parsing the URL, it rejects any URL whose protocol is not 'https:'. This prevents credentials or job data from being sent over plaintext and blocks downgrade attacks. The thrown message includes the offending URL verbatim.

Solutions

  1. Change the scheme to https:// in the URL or in the portals.yml entry.
  2. Search the config for 'http://' occurrences and replace with 'https://'.
  3. If the target genuinely does not support HTTPS, do not bypass the check — treat the endpoint as unusable and remove or replace the entry.
  4. Test the corrected URL with new URL(u).protocol === 'https:' before calling the provider.

Example fix

// before
assertLandingUrl('http://landingjobs.co/api/jobs');
// after
assertLandingUrl('https://landingjobs.co/api/jobs');
Defensive patterns

Strategy: validation

Validate before calling

function isHttpsUrl(u) { try { return new URL(u).protocol === 'https:'; } catch { return false; } }
if (!isHttpsUrl(url)) throw new Error(`refusing non-HTTPS endpoint: ${url}`);

Type guard

function isHttpsUrlString(v) { if (typeof v !== 'string') return false; try { return new URL(v).protocol === 'https:'; } catch { return false; } }

Try / catch

try {
  provider.fetch(entry, ctx);
} catch (e) {
  if (e.message.startsWith('landingjobs: URL must use HTTPS')) {
    console.warn(`Upgrading to https: ${e.message}`);
    return provider.fetch({ ...entry, url: entry.url.replace(/^http:/, 'https:') }, ctx);
  }
  throw e;
}

Prevention

When it happens

Trigger: Passing a parsed-valid URL that uses http:, ftp:, or any non-https scheme — e.g. 'http://landingjobs.co/api/jobs' — to assertLandingUrl or to the provider's fetch path.

Common situations: Old config entries written before HTTPS was enforced, hand-typed http:// URLs in portals.yml, or URLs sourced from external data that still point at plain HTTP.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of santifer/career-ops@aac998c7ed (2026-09-16). Data as JSON: /api/errors/2120e26f3df6d891. Report an issue: GitHub.

Appendix: source

Thrown at providers/landingjobs.mjs:28

// NOTE: the v1 feed carries no company-name field — the employer slug only
// appears in the posting URL path (`https://landing.jobs/at/<slug>/<job>`), so
// `company` is derived best-effort from that slug (humanized) and falls back to
// the portal entry name. The whole active set is returned in one call.
//
// Wire in via a `job_boards:` entry with `provider: landingjobs`.

const FEED_URL = 'https://landing.jobs/api/v1/jobs';
const TRUSTED_HOST = 'landing.jobs';

/** @param {string} url */
function assertLandingUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`landingjobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`landingjobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`landingjobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

// NaN-safe Date.parse.
function toEpochMs(value) {
  if (typeof value !== 'string' || !value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

/**
 * Derive a best-effort company name from a Landing.jobs posting URL.
 * Posting URLs are `https://landing.jobs/at/<slug>/<job>`; the `<slug>` is
 * humanized (hyphens/underscores → spaces, title-cased). Returns '' when the
 * URL is not the expected `/at/<slug>/…` shape. Exported for unit tests.

View on GitHub (pinned to aac998c7ed)