tursodatabase/turso · error · InvalidOperationException

Auth Token requires HTTPS sync requests unless the host is l

Error message

Auth Token requires HTTPS sync requests unless the host is localhost or loopback.

What it means

ValidateAuthTransport enforces that when an AuthToken is configured, sync HTTP requests use HTTPS unless the target host is localhost/loopback. This prevents the bearer token from being sent in cleartext over the network.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoSyncDatabase.cs:766

            _operationLock.Release();
        }
    }

    internal static void ValidateAuthTransport(
        Uri requestUri,
        Uri configuredRemoteUri,
        string? authToken)
    {
        if (string.IsNullOrWhiteSpace(authToken))
            return;
        if (!HasSameOrigin(requestUri, configuredRemoteUri))
        {
            throw new InvalidOperationException(
                "Refusing to send the sync auth token to an origin other than the configured remote.");
        }
        if (requestUri.Scheme != Uri.UriSchemeHttps && !requestUri.IsLoopback)
        {
            throw new InvalidOperationException(
                "Auth Token requires HTTPS sync requests unless the host is localhost or loopback.");
        }
    }

    private static bool HasSameOrigin(Uri left, Uri right)
    {
        return left.Scheme.Equals(right.Scheme, StringComparison.OrdinalIgnoreCase)
               && left.IdnHost.Equals(right.IdnHost, StringComparison.OrdinalIgnoreCase)
               && left.Port == right.Port;
    }

    private static Uri NormalizeRemoteUri(Uri uri)
    {
        var scheme = uri.Scheme.ToLowerInvariant() switch
        {
            "turso" or "libsql" => Uri.UriSchemeHttps,
            "http" => Uri.UriSchemeHttp,
            "https" => Uri.UriSchemeHttps,

View on GitHub (pinned to 6c72522679)

Solutions

1. Change the remote URI scheme to https (or use turso:// or libsql://, which normalize to https)
2. If this is truly local, use localhost or a 127.0.0.1/::1 address so the loopback exemption applies
3. Set up TLS on the sync server (e.g. a reverse proxy terminating TLS)
4. Remove the AuthToken only if the endpoint genuinely requires no authentication

Example fix

// before
var options = new TursoSyncDatabaseOptions(path, new Uri("http://my-turso-server.example.com")) { AuthToken = token };
// after
var options = new TursoSyncDatabaseOptions(path, new Uri("https://my-turso-server.example.com")) { AuthToken = token };

bool TokenTransportIsSecure(Uri remote, string? authToken) =>
    string.IsNullOrWhiteSpace(authToken) || remote.Scheme == Uri.UriSchemeHttps || remote.IsLoopback;
// check before constructing options:
// if (!TokenTransportIsSecure(remoteUri, token)) throw new ArgumentException("Use https or loopback for token sync.");

try
{
    await db.SyncAsync(ct);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("requires HTTPS"))
{
    logger.LogError(ex, "Auth token would be sent over plain HTTP; refusing.");
    throw;
}

When it happens

Trigger: Syncing with AuthToken set while the effective requestUri scheme is http and the host is not loopback (e.g. remote set to http://myserver.example.com, or a turso:// remote resolved to plain http, or an http redirect target).

Common situations: Pointing the remote at a staging/self-hosted server over plain http; using http:// in local config files deployed to production; a proxy or redirect downgrading https to http.

Related errors

• Auth Token requires an HTTPS sync URL unless the host is loc
• Auth Token requires an HTTPS remote Turso URL unless the hos
• Refusing to send the sync auth token to an origin other than
• Use AuthToken instead of embedding credentials in the sync U
• Automatic sync is not supported for embedded replica connect

AI-assisted analysis of tursodatabase/turso@6c72522679 (2026-08-31). Data as JSON: /api/errors/38ad36436ace6b3e. Report an issue: GitHub.