DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

ConfigNotFoundError thrown by the Mastodon local-timeline route when :site is not allowlisted and ALLOW_USER_SUPPLY_UNSAFE_DOMAIN is false. The route then calls http://<site>/api/v1/timelines/public?local=true; the guard exists to stop RSSHub from being pointed at arbitrary hosts.

Source

Thrown at lib/routes/mastodon/timeline-local.ts:43

    features: {
        requireConfig: false,
        requirePuppeteer: false,
        antiCrawler: false,
        supportBT: false,
        supportPodcast: false,
        supportScihub: false,
    },
    name: 'Instance timeline (local)',
    maintainers: ['hoilc'],
    handler,
    description: 'If the instance address is not `mastodon.social` or `pawoo.net`, then the route requires `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN` to be `true`.',
};

async function handler(ctx) {
    const site = ctx.req.param('site');
    const only_media = ctx.req.param('only_media') === 'true' ? 'true' : 'false';
    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }

    const url = `http://${site}/api/v1/timelines/public?local=true&only_media=${only_media}`;

    const response = await got.get(url, { headers: utils.apiHeaders(site) });
    const list = response.data;

    return {
        title: `Local Public${ctx.req.param('only_media') === 'true' ? ' Media' : ''} Timeline on ${site}`,
        link: `https://${site}`,
        item: utils.parseStatuses(list),
    };
}

View on GitHub (pinned to bed535e087)

Solutions

1. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true on trusted/private deployments.
2. Set MASTODON_API_HOST to your instance so it joins the allowlist.
3. Confirm the site is a bare hostname reachable over HTTPS.
4. For public deployments, keep the guard on and request an allowlist entry.

const ALLOWED = ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean);
if (!ALLOWED.includes(site) && !config.feature.allow_user_supply_unsafe_domain) {
    throw new ConfigNotFoundError('Instance not allowlisted; set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or MASTODON_API_HOST');
}

const isAllowlistedSite = (site: string): boolean =>
    ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean).includes(site);

When it happens

Trigger: GET /mastodon/timeline-local/:site/:only_media? where :site is not in allowSiteList and the unsafe-domain feature flag is false.

Common situations: Subscribing to a local timeline on a non-allowlisted instance; deploying a public RSSHub with the SSRF guard intentionally enabled; site segment malformed.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UN
• Mastodon RSS is disabled due to the lack of <a href="https:/

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/2682272c280137ed. Report an issue: GitHub.