DIYgod/RSSHub · warning · ConfigNotFoundError

RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UN

Error message

RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true' or 'MASTODON_API_HOST' is set.

What it means

ConfigNotFoundError thrown inside getAccountIdByAcct when the resolved site is not in allowSiteList and config.feature.allow_user_supply_unsafe_domain is false. This is the same SSRF guard as the site-param Mastodon routes, applied to the acct-based lookup so a user cannot point the search at an arbitrary host.

Source

Thrown at lib/routes/mastodon/utils.ts:100

        });
        account_data = account_response.data;
    }

    return { account_data, data };
}

async function getAccountIdByAcct(acct) {
    const mastodonConfig = config.mastodon;

    // acctHost is from the acct param of the request, and acctDomain is from either acctHost or the config
    const acctHost = acct.split('@').filter(Boolean)[1];
    const site = mastodonConfig.apiHost || acctHost;
    const acctDomain = mastodonConfig.acctDomain || acctHost;
    if (!(site && acctDomain)) {
        throw new ConfigNotFoundError('Mastodon RSS is disabled due to the lack of <a href="https://docs.rsshub.app/deploy/config#route-specific-configurations">relevant config</a>');
    }
    if (!config.feature.allow_user_supply_unsafe_domain && !allowSiteList.includes(site)) {
        throw new ConfigNotFoundError(`RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true' or 'MASTODON_API_HOST' is set.`);
    }

    const search_url = `https://${site}/api/v2/search`;
    const cacheUid = `mastodon_acct_id/${site}/${acct}`;

    const account_id = await cache.tryGet(cacheUid, async () => {
        const search_response = await got({
            method: 'get',
            url: search_url,
            headers: apiHeaders(site),
            searchParams: {
                q: acct,
                type: 'accounts',
            },
        });
        const [acctUser, acctHost] = acct.split('@').filter(Boolean);
        let acctOnServer;

View on GitHub (pinned to bed535e087)

Solutions

1. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true on trusted/private deployments.
2. Set MASTODON_API_HOST to the instance you want to allow (adds it to allowSiteList).
3. Double-check the instance segment of the acct is correct and reachable.
4. On public deployments, keep the guard and request an allowlist addition.

const ALLOWED = ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean);
if (!ALLOWED.includes(site) && !config.feature.allow_user_supply_unsafe_domain) {
    throw new ConfigNotFoundError('Instance not allowlisted; set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or MASTODON_API_HOST');
}

const isAllowlistedSite = (site: string): boolean =>
    ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean).includes(site);

When it happens

Trigger: acct 'user@some-random.instance' resolves site to 'some-random.instance', which is not mastodon.social/pawoo.net/fosstodon.org/MASTODON_API_HOST, and ALLOW_USER_SUPPLY_UNSAFE_DOMAIN is false.

Common situations: Following a remote account whose instance is not allowlisted; public RSSHub with the SSRF guard on; user supplied the wrong instance segment.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• Mastodon RSS is disabled due to the lack of <a href="https:/

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/2869f6c25ee2e836. Report an issue: GitHub.