windmill-labs/windmill · error

HTTP_PROXY url cannot contain https scheme.

Error message

HTTP_PROXY url cannot contain https scheme.

What it means

Windmill translates the standard proxy environment variables into Java system properties (`-Dhttp.proxyHost` etc.) for Java jobs. HTTP_PROXY must point at an http-scheme proxy URL; if the value contains `https://`, the parser rejects it because Java's http.proxy* settings only apply to plain-HTTP proxy endpoints and mixing schemes would silently misroute traffic.

Source

Thrown at backend/windmill-worker/src/java_executor.rs:953

        match ident {
            "HTTPS_PROXY" => {
                if !val.contains("://") {
                    val = format!("https://{val}");
                }
                let mut url = url::Url::parse(&val)?;
                let port = url.port();
                {
                    url.set_port(None).unwrap_or_default();
                    let host = url.as_str().replace("https://", "").replace("http://", "");
                    jps.https_host = Some(host);
                    if let Some(port) = port {
                        jps.https_port = Some(format!("{}", port));
                    }
                }
            }
            "HTTP_PROXY" => {
                if val.contains("https://") {
                    bail!("HTTP_PROXY url cannot contain https scheme.");
                }
                if !val.contains("http://") {
                    val = format!("http://{val}");
                }
                let mut url = url::Url::parse(&val)?;
                let port = url.port();
                // Make sure port and schema is not included in final url
                {
                    url.set_port(None).unwrap_or_default();
                    jps.http_host = Some(url.as_str().replace("http://", ""));
                    if let Some(port) = port {
                        jps.https_port = Some(format!("{}", port));
                    }
                }
            }
            // Java uses | instead of ,
            "NO_PROXY" => jps.no_proxy = Some(val.replace(",", "|")),
            _ => {}

View on GitHub (pinned to e474e8803c)

Solutions

1. Change HTTP_PROXY in the worker environment to use the `http://` scheme, e.g. `http://proxy.corp:8080` (keep `HTTPS_PROXY=https://...` if the proxy itself is TLS)
2. If the proxy is plain HTTP and the value lacks any scheme, leave it scheme-less — Windmill prepends `http://` automatically
3. Restart the worker after fixing the env so the proxy vars are re-read

Example fix

# before (worker env)
HTTP_PROXY=https://proxy.corp:8080
# after
HTTP_PROXY=http://proxy.corp:8080
HTTPS_PROXY=http://proxy.corp:8080

#!/bin/sh
# worker startup guard
case "$HTTP_PROXY" in
  https://*) echo "HTTP_PROXY must not use https scheme"; exit 1;;
esac

fn is_valid_http_proxy(v: &str) -> bool {
    !v.contains("https://") && (v.contains("http://") || !v.contains("://"))
}

When it happens

Trigger: A worker environment has `HTTP_PROXY=https://...` set (commonly one TLS-terminating proxy URL exported for both HTTP_PROXY and HTTPS_PROXY) and any Java job runs, since parse_proxy is called by resolve, install, and run paths.

Common situations: Ops teams setting all proxy vars to the same `https://proxy:port` URL; Docker/corporate images exporting an https-scheme HTTP_PROXY; copy-pasting the HTTPS_PROXY value into HTTP_PROXY.

Related errors

• ${what} failed:\n${output}
• No instance found, please add one first
• No local instance profile named ${instanceName}
• No active instance. Run 'wmill instance add' or pass --insta
• Active instance ${activeName} not found in config

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/e58bc2fa021677d4. Report an issue: GitHub.