DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

ConfigNotFoundError thrown by the Mastodon account-id route when the requested instance (site path param) is not in the built-in allowSiteList (mastodon.social, pawoo.net, fosstodon.org, or the configured MASTODON_API_HOST) and config.feature.allow_user_supply_unsafe_domain is false. This is an SSRF guard: RSSHub refuses to fetch arbitrary user-supplied hostnames unless explicitly opted in.

Source

Thrown at lib/routes/mastodon/account-id.ts:43

    features: {
        requireConfig: false,
        requirePuppeteer: false,
        antiCrawler: false,
        supportBT: false,
        supportPodcast: false,
        supportScihub: false,
    },
    name: 'User timeline (by account ID)',
    maintainers: ['notofoe', 'pseudoyu'],
    handler,
};

async function handler(ctx) {
    const site = ctx.req.param('site');
    const account_id = ctx.req.param('account_id');
    const only_media = ctx.req.param('only_media') === 'true' ? 'true' : 'false';
    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }

    const { account_data, data } = await utils.getAccountStatuses(site, account_id, only_media);

    return {
        title: `${account_data.display_name} (@${account_data.acct})`,
        link: account_data.url,
        description: account_data.note,
        item: utils.parseStatuses(data),
        allowEmpty: true,
    };
}

View on GitHub (pinned to bed535e087)

Solutions

1. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in the RSSHub environment (only for trusted/private deployments, since it disables the SSRF guard).
2. Set MASTODON_API_HOST to your instance (e.g. mastodon.online) so it is added to allowSiteList.
3. Use the acct-based route with a preconfigured instance rather than supplying a raw site in the URL.
4. If you run a public instance, do NOT enable this and instead request the maintainers allowlist the instance.

const ALLOWED = ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean);
if (!ALLOWED.includes(site) && !config.feature.allow_user_supply_unsafe_domain) {
    throw new ConfigNotFoundError('Instance not allowlisted; set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or MASTODON_API_HOST');
}

const isAllowlistedSite = (site: string): boolean =>
    ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean).includes(site);

When it happens

Trigger: GET /mastodon/account-id/:site/:account_id/:only_media? where :site is e.g. 'mastodon.online' (not in the allowlist) and ALLOW_USER_SUPPLY_UNSAFE_DOMAIN is unset/false.

Common situations: User wants to follow an account on an instance that is not on the curated allowlist; operator deploying a public RSSHub and unwilling to allow arbitrary domains; misconfiguration where they set the env var under a slightly different name.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UN
• Mastodon RSS is disabled due to the lack of <a href="https:/

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/c797464b30758b35. Report an issue: GitHub.