Problem
With a Connect server configured with [HTTPRedirect] (http://host:3939 redirects to https://host:3443), Add Credential fails no matter how the URL is entered when Verify TLS Certificates is disabled:
http://host:3939 → Error: Invalid URL (unable to validate connectivity with Server URL - Protocol "http:" not supported. Expected "https:".)
host:3939 → Error: Invalid URL (unable to validate connectivity with Server URL - Unable to reach the server. ...) (Publisher defaults to https, and a TLS handshake against the plain-HTTP port fails; this is expected — type the scheme explicitly)
Causes
- When certificate verification is disabled, the custom transport in
@posit-dev/connect-api hard-codes https.request, so any http: URL fails with Node's ERR_INVALID_PROTOCOL. This also breaks all plain-http Connect servers when verification is disabled, redirect or not.
- That transport also does not follow redirects, so the http→https upgrade redirect can never be followed in insecure mode.
- Even in secure mode, where axios follows the redirect, the post-redirect URL is discarded — the credential is stored with the typed
http:// URL, so every subsequent request (including ones carrying Authorization headers) first goes out over plaintext http.
Fix
- Dispatch the insecure transport on the request protocol (
http.request vs https.request).
- Resolve redirects once, unauthenticated, while validating the server URL, and store the resolved (https) URL in the credential.
Problem
With a Connect server configured with
[HTTPRedirect](http://host:3939 redirects to https://host:3443), Add Credential fails no matter how the URL is entered when Verify TLS Certificates is disabled:http://host:3939→Error: Invalid URL (unable to validate connectivity with Server URL - Protocol "http:" not supported. Expected "https:".)host:3939→Error: Invalid URL (unable to validate connectivity with Server URL - Unable to reach the server. ...)(Publisher defaults to https, and a TLS handshake against the plain-HTTP port fails; this is expected — type the scheme explicitly)Causes
@posit-dev/connect-apihard-codeshttps.request, so anyhttp:URL fails with Node'sERR_INVALID_PROTOCOL. This also breaks all plain-http Connect servers when verification is disabled, redirect or not.http://URL, so every subsequent request (including ones carryingAuthorizationheaders) first goes out over plaintext http.Fix
http.requestvshttps.request).