Invalid {field} URL scheme '{scheme}'. Allowed: http, https,

Error message

Invalid {field} URL scheme '{scheme}'. Allowed: http, https, socks5, socks5h

What it means

validate_proxy_url parses each proxy URL (http_proxy/https_proxy/all_proxy) with reqwest::Url and rejects any scheme other than http, https, socks5 or socks5h — the HTTP client stack only speaks those proxy protocols. Note that a scheme-less value like "127.0.0.1:7890" parses with '127.0.0.1' as the scheme and lands on this same error.

Source

Thrown at src/openhuman/config/schema/proxy.rs:328

    if let Some(prefix) = selector.strip_suffix(".*") {
        return service_key.starts_with(prefix)
            && service_key
                .strip_prefix(prefix)
                .is_some_and(|suffix| suffix.starts_with('.'));
    }

    false
}

fn validate_proxy_url(field: &str, url: &str) -> Result<()> {
    let parsed = reqwest::Url::parse(url)
        .with_context(|| format!("Invalid {field} URL: '{url}' is not a valid URL"))?;

    match parsed.scheme() {
        "http" | "https" | "socks5" | "socks5h" => {}
        scheme => {
            anyhow::bail!(
                "Invalid {field} URL scheme '{scheme}'. Allowed: http, https, socks5, socks5h"
            );
        }
    }

    if parsed.host_str().is_none() {
        anyhow::bail!("Invalid {field} URL: host is required");
    }

    Ok(())
}

fn set_proxy_env_pair(key: &str, value: Option<&str>) {
    let lowercase_key = key.to_ascii_lowercase();
    if let Some(value) = value.and_then(|candidate| normalize_proxy_url_option(Some(candidate))) {
        std::env::set_var(key, &value);
        std::env::set_var(lowercase_key, value);
    } else {

View on GitHub (pinned to 7491200858)

Solutions

Prefix the value with an allowed scheme: http://, https://, socks5://, or socks5h:// (e.g. http://127.0.0.1:7890)
For SOCKS proxies use socks5:// (local DNS) or socks5h:// (DNS resolved by the proxy)
If the endpoint is ftp:// or ssh://, it is not an HTTP proxy — terminate it locally first and point the config at that local http/socks5 listener

Example fix

# before
http_proxy = "127.0.0.1:7890"

# after
http_proxy = "http://127.0.0.1:7890"

Defensive patterns

Strategy: validation

Validate before calling

fn check_proxy_url(field: &str, url: &str) -> Result<(), String> {
    let parsed: reqwest::Url = url.parse().map_err(|e| format!("{field}: unparseable: {e}"))?;
    match parsed.scheme() {
        "http" | "https" | "socks5" | "socks5h" => Ok(()),
        s => Err(format!("{field}: scheme '{s}' not allowed (http/https/socks5/socks5h)")),
    }
}

Try / catch

Catch the config-load error; when the message contains 'URL scheme', echo the offending field name and the four allowed schemes back to the user rather than failing silently.

Prevention

Always write proxy URLs fully qualified, including the scheme
Validate the scheme in settings UIs before save
Remember scheme matching is lowercase — socks5h works, SOCKS5H does not

When it happens

Trigger: Setting http_proxy="ftp://proxy:21", all_proxy="socks4://127.0.0.1:1080", or a bare host:port like "127.0.0.1:7890" in [proxy] config or env overrides; validation runs at config load.

Common situations: Copy-pasting a SOCKS4 or SSH tunnel endpoint; forgetting the http:// prefix for a local proxy (Clash/V2Ray style defaults); using ws:// for a tunnel; typos like 'socks5H://' (scheme matching is lowercase).

Related errors

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/a1d26e73cd41cf73. Report an issue: GitHub.