santifer/career-ops · error · Error

solidjobs: URL must use HTTPS: ${url}

Error message

solidjobs: URL must use HTTPS: ${url}

What it means

assertUrl's second check rejects any URL whose protocol is not exactly 'https:'. It fires after a successful parse but before the host/path checks, so the URL is well-formed but insecure.

Source

Thrown at providers/solidjobs.mjs:27

const ALLOWED_HOSTS = new Set(['solid.jobs']);

/**
 * Validates that the provided URL is a trusted SolidJobs API endpoint.
 * Enforces HTTPS protocol, strict hostname matching, and required path prefix.
 * 
 * @param {string} url - The URL string to validate.
 * @returns {string} The validated URL string.
 * @throws {Error} If the URL is malformed, uses non-HTTPS, has an untrusted host, or wrong path.
 */
function assertUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`solidjobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`solidjobs: URL must use HTTPS: ${url}`);
  if (!ALLOWED_HOSTS.has(parsed.hostname))
    throw new Error(`solidjobs: untrusted hostname "${parsed.hostname}" — must be solid.jobs`);
  if (!parsed.pathname.startsWith('/public-api/offers/'))
    throw new Error(`solidjobs: URL path must start with /public-api/offers/: ${url}`);
  return url;
}

/** @type {Provider} */
export default {
  id: 'solidjobs',

  /**
   * Attempts to detect if the provider can handle the given entry by checking the careers_url.
   * * @param {{ careers_url?: string, name?: string }} entry - The configuration entry.
   * @returns {{url: string} | null} An object with the matched URL, or null if not matched.
   */
  detect(entry) {
    const url = entry.careers_url || '';

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Change the scheme from http:// to https://
2. Confirm solid.jobs serves the API over https (it does)
3. Re-run the scan to confirm the entry now resolves

Example fix

# before
careers_url: http://solid.jobs/public-api/offers/it
# after
careers_url: https://solid.jobs/public-api/offers/it

// Enforce https before the provider's own check fires.
function isHttps(v) {
  try { return new URL(v).protocol === 'https:'; } catch { return false; }
}
if (!isHttps(entry.careers_url)) {
  console.warn(`${entry.name}: careers_url must use https://`);
}

When it happens

Trigger: entry.careers_url is a valid http:// URL pointing at solid.jobs (e.g. http://solid.jobs/public-api/offers/it). The provider is HTTPS-only by policy.

Common situations: A careers_url copied from a non-secure source, an old bookmark, or a tenant that still serves http. The fix is mechanical: upgrade the scheme.

Related errors

• solidjobs: invalid URL: ${url}
• solidjobs: untrusted hostname "${parsed.hostname}" — must be
• solidjobs: URL path must start with /public-api/offers/: ${u
• teamtailor: URL must use HTTPS: ${url}
• glints: invalid URL: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/3a8397537089cf30. Report an issue: GitHub.