Allow /delay endpoints in the Clash API to query HTTP (non-HTTPS) resources

Operating system

Linux

System version

Ubuntu 24.04.1 LTS

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.12.12

Environment: go1.25.3 linux/arm64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale
Revision: 54ed58499d7063136ed52dabf87d179d252425d0
CGO: disabled

Description

Hello!

I noticed that when passing a url parameter with an http:// scheme (for example, http://captive.apple.com) to the /delay endpoint of the Clash API, the request is actually made to www.gstatic.com instead of captive.apple.com.

GET http://localhost:9090/group/blocked-selector-out/delay?url=http://captive.apple.com&timeout=2000

2025-12-11 13:42:53 INFO outbound/direct[warp-out]: outbound connection to www.gstatic.com:443
2025-12-11 13:42:53 INFO outbound/vless[first-vless-out]: outbound connection to www.gstatic.com:443
2025-12-11 13:42:53 INFO outbound/vless[second-vless-out]: outbound connection to www.gstatic.com:443

However, if I pass captive.apple.com with the https:// scheme, the request is made to the correct host.

GET http://localhost:9090/group/blocked-selector-out/delay?url=https://captive.apple.com&timeout=2000

2025-12-11 13:46:54 INFO outbound/direct[warp-out]: outbound connection to captive.apple.com:443
2025-12-11 13:46:54 INFO outbound/vless[first-vless-out]: outbound connection to captive.apple.com:443
2025-12-11 13:46:54 INFO outbound/vless[second-vless-out]: outbound connection to captive.apple.com:443

I assume this behavior is caused by https://github.com/SagerNet/sing-box/blob/b2316b5c9d931e30dce143770c3019865673d101/experimental/clashapi/api_meta_group.go#L71

Could you clarify why this is implemented this way?

The url parameter in a URLTest outbound can query HTTP resources without any issues, but the Clash API does not allow this.

P.S.
I intentionally checked the box saying that I provided a “simple configuration,” even though there is no configuration included in the issue, because I believe that no configuration example is actually needed for this question.
If you still require a configuration example, please do not close the issue — just let me know, and I will prepare one for you.

Reproduction

1. Execute the following requests (replace <outbound_tag> and/or <group_outbound_tag> with your own values):

curl "http://localhost:9090/proxies/<outbound_tag>/delay?timeout=2000&url=http://captive.apple.com"

curl "http://localhost:9090/group/<group_outbound_tag>/delay?timeout=2000&url=http://captive.apple.com"

2. Check the logs and verify that sing-box does not query captive.apple.com, but instead connects to www.gstatic.com, and over HTTPS instead of HTTP.

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start in experimental/clashapi/api_meta_group.go at the behavior identified around line 71, then trace the /proxies and /group delay handlers. Reproduce the requests with curl using an http:// URL and inspect the outbound logs; done means the requested HTTP host and scheme are used instead of www.gstatic.com over HTTPS.