santifer/career-ops · error · Error

remotli: URL must use HTTPS: ${url}

Error message

remotli: URL must use HTTPS: ${url}

What it means

assertRemotliUrl rejects any URL whose protocol is not 'https:'. remotli pins every request to remotli.ch over TLS, so an http: scheme is treated as a hard error. Because remotli builds URLs from constants, an http ORIGIN or an externally-supplied http URL would trip this.

Source

Thrown at providers/remotli.mjs:240

  const postedAt = toEpochMs(job.publishedAt || job.createdAt);
  if (postedAt !== undefined) out.postedAt = postedAt;

  const salary = resolveSalary(job);
  if (salary) out.salary = salary;

  return out;
}

/** Guard the API URL: HTTPS + remotli.ch only. */
function assertRemotliUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`remotli: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`remotli: URL must use HTTPS: ${url}`);
  if (!HOST_RE.test(parsed.hostname))
    throw new Error(`remotli: untrusted hostname "${parsed.hostname}" — must be remotli.ch`);
  return url;
}

/** @type {Provider} */
export default {
  id: 'remotli',

  detect(entry) {
    const raw = typeof entry.careers_url === 'string' ? entry.careers_url : '';
    if (!raw) return null;
    let parsed;
    try {
      parsed = new URL(raw);
    } catch {
      return null;
    }

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Ensure ORIGIN is 'https://remotli.ch'.
2. If a URL was supplied externally, upgrade it: url.replace(/^http:/, 'https:').
3. Search the codebase for any http://remotli reference and replace with https://.

Example fix

// before
const ORIGIN = 'http://remotli.ch';
// after
const ORIGIN = 'https://remotli.ch';

function ensureHttps(raw) {
  return typeof raw === 'string' ? raw.replace(/^http:\/\//i, 'https://') : raw;
}
const ORIGIN = ensureHttps('https://remotli.ch'); // guard against config drift

null

try {
  await provider.fetch(entry, ctx);
} catch (e) {
  if (/must use HTTPS/.test(e.message)) {
    console.error('[bug] remotli ORIGIN is http — fix the constant');
  } else throw e;
}

When it happens

Trigger: ORIGIN constant was set to 'http://remotli.ch'; a URL string passed in starts with http://; the hostname resolves but the scheme is cleartext.

Common situations: The ORIGIN constant was misconfigured during local development or testing; a config override switched to http.

Related errors

• recruitee: URL must use HTTPS: ${url}
• remotli: untrusted hostname "${parsed.hostname}" — must be r
• rippling: URL must use HTTPS: ${url}
• smartrecruiters: URL must use HTTPS: ${url}
• a16z-speedrun-talent: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/2ad962a92430a95f. Report an issue: GitHub.