DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

ConfigNotFoundError thrown by the Mastodon federated/remote-timeline route when :site is not allowlisted and ALLOW_USER_SUPPLY_UNSAFE_DOMAIN is false. Mirrors the local-timeline guard; the route subsequently fetches http://<site>/api/v1/timelines/public?remote=true.

Source

Thrown at lib/routes/mastodon/timeline-remote.ts:43

    features: {
        requireConfig: false,
        requirePuppeteer: false,
        antiCrawler: false,
        supportBT: false,
        supportPodcast: false,
        supportScihub: false,
    },
    name: 'Instance timeline (federated)',
    maintainers: ['hoilc'],
    handler,
    description: 'If the instance address is not `mastodon.social` or `pawoo.net`, then the route requires `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN` to be `true`.',
};

async function handler(ctx) {
    const site = ctx.req.param('site');
    const only_media = ctx.req.param('only_media') === 'true' ? 'true' : 'false';
    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }

    const url = `http://${site}/api/v1/timelines/public?remote=true&only_media=${only_media}`;

    const response = await got.get(url, { headers: utils.apiHeaders(site) });
    const list = response.data;

    return {
        title: `Federated Public${ctx.req.param('only_media') === 'true' ? ' Media' : ''} Timeline on ${site}`,
        link: `https://${site}`,
        item: utils.parseStatuses(list),
    };
}

View on GitHub (pinned to bed535e087)

Solutions

1. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true for private/trusted setups.
2. Set MASTODON_API_HOST to your instance to allowlist it.
3. Ensure the site is a reachable Mastodon host.
4. On public deployments, keep the guard and request an allowlist addition.

const ALLOWED = ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean);
if (!ALLOWED.includes(site) && !config.feature.allow_user_supply_unsafe_domain) {
    throw new ConfigNotFoundError('Instance not allowlisted; set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or MASTODON_API_HOST');
}

const isAllowlistedSite = (site: string): boolean =>
    ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean).includes(site);

When it happens

Trigger: GET /mastodon/timeline-remote/:site/:only_media? where :site is not in allowSiteList and the feature flag is off.

Common situations: Watching the federated timeline of a non-allowlisted instance; public RSSHub with guard enabled; wrong/typo'd site hostname.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UN
• Mastodon RSS is disabled due to the lack of <a href="https:/

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/7d9a6425105736be. Report an issue: GitHub.