Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Nu1302 documentation with more information #3363

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update Nu1302 documentation with more information #3363

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions docs/reference/errors-and-warnings/NU1302.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,38 @@ f1_keywords:
- "NU1302"
---

# NuGet Warning NU1302
# NuGet Error NU1302

> You are running the 'restore' operation with an 'HTTP' source: myHttpSource. NuGet requires HTTPS sources. To use an HTTP source, you must explicitly set 'allowInsecureConnections' to true in your NuGet.Config file. Please refer to https://aka.ms/nuget-https-everywhere for more information.

### Issue

`myHttpSource` is an insecure HTTP source. We recommend using HTTPS sources instead.
`myHttpSource` is an insecure HTTP source. We recommend using an HTTPS sources instead.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`myHttpSource` is an insecure HTTP source. We recommend using an HTTPS sources instead.
`myHttpSource` is an insecure HTTP source. We recommend using an HTTPS source instead.


### Solution

This can be fixed either by removing the HTTP source or disabling HTTP Errors for the specific source by using `allowInsecureConnections` option in your [NuGet config file](../../reference/nuget-config-file.md).
#### Option 1: Update the Source to Use HTTPS
If possible, update the package source to use `https://` instead of `http://`:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add space after each heading.
It's a good idea to install markdown lint to help you catch these issues.

```xml
<configuration>
<packageSources>
<add key="SecureSource" value="https://example.com/nuget/" />
</packageSources>
</configuration>
```
#### Option 2: Allow Insecure Connections (If Necessary)
If the source must remain HTTP, explicitly allow insecure connections by adding the `AllowInsecureConnections` flag in the `NuGet.Config`:
```xml
<configuration>
<packageSources>
<add key="InsecureSource" value="http://example.com/nuget/" allowInsecureConnections="true" />
</packageSources>
</configuration>
```

#### Option 3: Consult SDK Analysis Level
Ensure that the project’s `SdkAnalysisLevel` allows HTTP sources:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should probably link to the actual SdkAnalysisLevel docs. Similar to how this is done in the NU19* codes.

The value can be explicitly set to direct to revert back to .NET 8's default. Alternatively, the property SdkAnalysisLevel can be set to 8.0.400 to temporarily disable all new warnings and errors introduced in newer versions of the SDK. Specifically in this case, the default value of NuGetAuditMode is changed back to direct.

The following Ensure that the project’s SdkAnalysisLevel allows HTTP sources: makes me think SdkAnalysisLevel is about supporting, but it's really about previous behavior.
SdkAnalysisLevel won't always work. The primary motivator behind it is a temporary usage until you address the problem later, so let's rephrase is in a way to reflect that.

- SDK versions **below 9.0.100** generate a warning (NU1803).
- SDK versions **9.0.100 or higher** enforce the error (NU1302) unless `AllowInsecureConnections` is explicitly enabled.

Check the `SdkAnalysisLevel` of your project and upgrade or adjust settings as necessary.