Skip to content

Commit

Permalink
Update Nu1302 documentation with more information (#3363)
Browse files Browse the repository at this point in the history
  • Loading branch information
Nigusu-Allehu authored Dec 10, 2024
1 parent 6728686 commit b3cd276
Showing 1 changed file with 36 additions and 3 deletions.
39 changes: 36 additions & 3 deletions docs/reference/errors-and-warnings/NU1302.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,47 @@ f1_keywords:
- "NU1302"
---

# NuGet Warning NU1302
# NuGet Error NU1302

> You are running the 'restore' operation with an 'HTTP' source: myHttpSource. NuGet requires HTTPS sources. To use an HTTP source, you must explicitly set 'allowInsecureConnections' to true in your NuGet.Config file. Please refer to https://aka.ms/nuget-https-everywhere for more information.
### Issue

`myHttpSource` is an insecure HTTP source. We recommend using HTTPS sources instead.
`myHttpSource` is an insecure HTTP source. We recommend using an HTTPS source instead.

### Solution

This can be fixed either by removing the HTTP source or disabling HTTP Errors for the specific source by using `allowInsecureConnections` option in your [NuGet config file](../../reference/nuget-config-file.md).
#### Option 1: Update the Source to Use HTTPS

If possible, update the package source to use `https://` instead of `http://`:

```xml
<configuration>
<packageSources>
<add key="SecureSource" value="https://example.com/nuget/" />
</packageSources>
</configuration>
```

#### Option 2: Allow Insecure Connections (If Necessary)

If the source must remain HTTP, explicitly allow insecure connections by adding the `AllowInsecureConnections` flag in the `NuGet.Config`:

```xml
<configuration>
<packageSources>
<add key="InsecureSource" value="http://example.com/nuget/" allowInsecureConnections="true" />
</packageSources>
</configuration>
```

#### Option 3: Consult SDK Analysis Level

The [`SdkAnalysisLevel`](/dotnet/core/project-sdk/msbuild-props#sdkanalysislevel) property in your project can serve as a temporary workaround for managing HTTP sources.
If additional time is needed to resolve the HTTP error, you can lower the `SdkAnalysisLevel` to suppress errors temporarily.
Here's how it functions:

- For SDK Analysis Level value **below 9.0.100**, using HTTP sources triggers a warning ([NU1803](NU1803.md)).
- Starting with SDK Analysis Level **9.0.100 or higher**, HTTP sources result in an error (NU1302) unless `AllowInsecureConnections` is explicitly enabled.


0 comments on commit b3cd276

Please sign in to comment.