santifer/career-ops · error · Error

nodesk: URL must use HTTPS: ${url}

Error message

nodesk: URL must use HTTPS: ${url}

What it means

Thrown by nodesk's assertNodeskUrl() after the URL parses successfully but its protocol is not 'https:'. This is the second SSRF gate: it prevents the provider from fetching over plaintext http://, which would expose the request to MITM and allow a redirect to an attacker-controlled host. The check runs before any network call.

Source

Thrown at providers/nodesk.mjs:22

// NoDesk provider - board-wide RSS feed
// (https://nodesk.co/remote-jobs/index.xml). The feed is public, no-auth,
// and XML, so it is parsed in-process with the same tiny tag extractor
// approach as providers/personio.mjs rather than adding an XML dependency.
//
// Wire in via a `job_boards:` entry with `provider: nodesk`.

const FEED_URL = 'https://nodesk.co/remote-jobs/index.xml';
const TRUSTED_HOST = 'nodesk.co';

/** @param {string} url */
function assertNodeskUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`nodesk: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`nodesk: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`nodesk: untrusted hostname "${parsed.hostname}" - must be ${TRUSTED_HOST}`);
  }
  return url;
}

// NaN-safe Date.parse - `|| undefined` would also coerce a valid epoch 0.
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

function fallbackCompany(entry) {
  return typeof entry?.name === 'string' && entry.name.trim() ? entry.name.trim() : 'NoDesk';
}

/** @type {Provider} */

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Change the URL to use https:// — for portals.yml, update the api or careers_url field from http:// to https://.
2. If testing against a local mock server, either run the mock on HTTPS (e.g. with mkcert) or use a test-specific override that bypasses assertNodeskUrl only in test mode.
3. Verify no middleware or proxy is downgrading the stored URL scheme before it reaches the provider.

Example fix

// before (portals.yml)
job_boards:
  nodesk:
    provider: nodesk
    api: 'http://nodesk.co/remote-jobs/index.xml'

// after
job_boards:
  nodesk:
    provider: nodesk
    api: 'https://nodesk.co/remote-jobs/index.xml'

/** Ensure a URL uses HTTPS before passing to the provider. */
function ensureHttps(url) {
  if (typeof url !== 'string') return null;
  return url.replace(/^http:\/\//i, 'https://');
}

// normalize config before scanning:
entry.api = ensureHttps(entry.api) || entry.api;

/** @param {string} url @returns {boolean} */
function isHttpsUrl(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}

try {
  await nodeskProvider.fetch(entry, ctx);
} catch (err) {
  if (String(err.message).includes('must use HTTPS')) {
    entry.api = entry.api.replace(/^http:/i, 'https:');
    // retry once with corrected scheme
    await nodeskProvider.fetch(entry, ctx);
  } else throw err;
}

When it happens

Trigger: The URL string is parseable (passed new URL()) but uses http:, ftp:, file:, or another non-https scheme. The most direct trigger is a config entry with api: 'http://nodesk.co/...' instead of 'https://'. Also fires if someone tests with a localhost http URL or a file:// URL pointing at a fixture.

Common situations: A portals.yml entry was authored with http:// (common copy-paste from a browser that didn't upgrade). In test environments, a developer points the URL at http://localhost:port for a mock server. A config-generation tool that strips SSL or normalizes to http also produces this.

Related errors

• nodesk: invalid URL: ${url}
• nofluffjobs: URL must use HTTPS: ${url}
• oraclecloud: URL must use HTTPS: ${url}
• personio: URL must use HTTPS: ${url}
• pinpoint: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/8bd4bb1541595fa0. Report an issue: GitHub.