|
| 1 | +--- |
| 2 | +title: NuGet HTTPS Everywhere |
| 3 | +description: Learn why NuGet enforces HTTPS connections for package sources, what errors like NU1302 mean, and how to safely allow HTTP feeds when necessary. |
| 4 | +author: Nigusu-Allehu |
| 5 | +ms.author: nyenework |
| 6 | +ms.date: 10/28/2025 |
| 7 | +ms.topic: conceptual |
| 8 | +ai-usage: ai-generated |
| 9 | +--- |
| 10 | + |
| 11 | +# NuGet HTTPS Everywhere |
| 12 | + |
| 13 | +NuGet requires all package sources to use **HTTPS** instead of **HTTP**. |
| 14 | +This enforcement protects the software supply chain by preventing tampering and interception during package restore and related operations. |
| 15 | +NuGet enforces this requirement by producing an error and stopping the operation when an HTTP source is used. |
| 16 | + |
| 17 | +## Understanding the HTTP Error |
| 18 | + |
| 19 | +This error occurs when one or more package sources in your configuration use an **HTTP** URL instead of **HTTPS**. |
| 20 | + |
| 21 | +In earlier NuGet versions, this scenario produced a **warning** ([`NU1803`](../reference/errors-and-warnings/nu1803.md)). |
| 22 | +Beginning with [**NuGet 6.12**](../release-notes/NuGet-6.12.md) and later, it now results in an **error** unless the use of HTTP sources is explicitly permitted. |
| 23 | + |
| 24 | +### Recommended Resolution |
| 25 | + |
| 26 | +Before allowing HTTP connections, confirm whether your package source supports HTTPS. |
| 27 | +If it does, update the feed URL to use the secure protocol: |
| 28 | + |
| 29 | +```xml |
| 30 | +<add key="MyFeed" value="https://contoso/packages/v3/index.json" /> |
| 31 | +``` |
| 32 | + |
| 33 | +Switching to HTTPS ensures end-to-end encryption and is the recommended and more secure approach. |
| 34 | + |
| 35 | +### Allowing Insecure HTTP Feeds (Opt-Out) |
| 36 | + |
| 37 | +If HTTPS is not available and you operate in a trusted or isolated environment, you can explicitly allow HTTP sources. |
| 38 | + |
| 39 | +#### Option 1: Set allowInsecureConnections in your `NuGet.Config` |
| 40 | + |
| 41 | +* **Use Visual Studio** |
| 42 | + |
| 43 | + Enable or disable allowing insecure HTTP connections with the [Package Sources settings](/nuget/consume-packages/nuget-visual-studio-options#allow-insecure-connections) under the Visual Studio options > **NuGet Package Manager**. |
| 44 | + |
| 45 | +* **Edit `NuGet.Config` manually** |
| 46 | + |
| 47 | + Add the `allowInsecureConnections="true"` attribute to the affected source: |
| 48 | + |
| 49 | + ```xml |
| 50 | + <?xml version="1.0" encoding="utf-8"?> |
| 51 | + <configuration> |
| 52 | + <packageSources> |
| 53 | + <add key="MyHttpFeed" value="http://contoso/packages/v3/index.json" allowInsecureConnections="true" /> |
| 54 | + </packageSources> |
| 55 | + </configuration> |
| 56 | + ``` |
| 57 | + |
| 58 | +#### Option 2: Use the Command-Line Parameter |
| 59 | + |
| 60 | +For commands that support it, include the following flag to temporarily permit HTTP connections: |
| 61 | + |
| 62 | +For **dotnet** commands: |
| 63 | + |
| 64 | +```bash |
| 65 | +--allow-insecure-connections |
| 66 | +``` |
| 67 | + |
| 68 | +For **NuGet.exe** commands, use: |
| 69 | + |
| 70 | +```powershell |
| 71 | +-AllowInsecureConnections |
| 72 | +``` |
| 73 | + |
| 74 | +#### Commands that support opt-out options |
| 75 | + |
| 76 | +| Tool | Commands | Support for Allow Insecure Connection | |
| 77 | +| -------------- | ------------------------- | ------------------------------------- | |
| 78 | +| **nuget.exe** | `push` | NuGet **7.0** | |
| 79 | +| **dotnet CLI** | `dotnet nuget push` | .NET **10.0.1xx** and newer | |
| 80 | +| **dotnet CLI** | `dotnet nuget add source` | .NET **9.0.1xx** and newer | |
| 81 | + |
| 82 | +## HTTPS Enforcement Rollout Across Tools |
| 83 | + |
| 84 | +NuGet’s HTTPS enforcement was introduced gradually across releases. |
| 85 | +The following table summarizes the progression from [**warnings (NU1803)**](../reference/errors-and-warnings/nu1803.md) to [**errors (NU1302)**](../reference/errors-and-warnings/nu1302.md). |
| 86 | + |
| 87 | +| Versions Affected | Behavior | |
| 88 | +| ----------------------------------------------------- | --------------------------------------------------------------------- | |
| 89 | +| [NuGet.exe 6.3](../release-notes/NuGet-6.3.md)+, Visual Studio 17.3+, .NET 6.0.100+ | ⚠️ **Warning (NU1803)** – HTTP sources allowed but discouraged | |
| 90 | +| [NuGet.exe 6.12](../release-notes/NuGet-6.12.md)+, Visual Studio 17.12+, .NET 9.0.100+ | ❌ **Error (NU1302)** – HTTP sources blocked unless explicitly allowed| |
| 91 | + |
| 92 | +## See Also |
| 93 | + |
| 94 | +* [NU1302](../reference/errors-and-warnings/nu1302.md) |
| 95 | +* [NU1803](../reference/errors-and-warnings/nu1803.md) |
| 96 | +* [NuGet.Config Reference](../reference/nuget-config-file.md#packagesources) |
| 97 | +* [NuGet Visual Studio Options](../consume-packages/nuget-visual-studio-options.md) |
0 commit comments