What causes "Invalid headers: expected an object" in FlowiseAI/Flowise?

Pass a plain object (an empty object {} is valid — zero entries passes).

FlowiseAI/Flowise · error · Error

Invalid headers: expected an object

Error message

Invalid headers: expected an object

What it means

validateCustomHeaders() guards the input itself before iterating: if headers is null/undefined or typeof !== 'object', it throws. Note that JS arrays satisfy typeof === 'object', so an array will pass this guard and fail later on key/value checks; null is caught here because of the `!headers` short-circuit.

Source

Thrown at packages/components/src/headerValidation.ts:41

    'x-auth-token',
    'x-amz-security-token'
])

const REDACTED_PLACEHOLDER = '[REDACTED]'

const MAX_HEADERS = 25
const MAX_KEY_LENGTH = 128
const MAX_VALUE_LENGTH = 2048

/**
 * Validates a set of user-supplied HTTP headers intended for outbound requests.
 * Rejects malformed keys, CRLF/control-char injection in values, hop-by-hop and
 * sensitive header names, and oversized payloads. Throws a plain Error; callers
 * are responsible for mapping to their own error types.
 */
export function validateCustomHeaders(headers: Record<string, string>): void {
    if (!headers || typeof headers !== 'object') {
        throw new Error('Invalid headers: expected an object')
    }

    const entries = Object.entries(headers)
    if (entries.length > MAX_HEADERS) {
        throw new Error(`Invalid headers: too many entries (max ${MAX_HEADERS})`)
    }

    for (const [key, value] of entries) {
        if (typeof key !== 'string' || key.length === 0) {
            throw new Error('Invalid header: key must be a non-empty string')
        }
        if (key.length > MAX_KEY_LENGTH) {
            throw new Error(`Invalid header "${key}": key exceeds ${MAX_KEY_LENGTH} chars`)
        }
        if (!RFC7230_TOKEN.test(key)) {
            throw new Error(`Invalid header "${key}": key contains illegal characters`)
        }

View on GitHub (pinned to abe4a8601a)

Solutions

Pass a plain object (an empty object {} is valid — zero entries passes).
Validate at the API boundary before calling validateCustomHeaders; coerce null/undefined to {} or reject the request.
Guard arrays explicitly if your caller might supply one (this function does not).

Example fix

// before
validateCustomHeaders(null) // throws
validateCustomHeaders(JSON.parse(emptyBody)) // null -> throws

// after
validateCustomHeaders(headers ?? {})
if (!headers || typeof headers !== 'object' || Array.isArray(headers)) return reject()

Defensive patterns

Strategy: type-guard

Validate before calling

// Reject non-objects (and arrays) before calling validateCustomHeaders
function isPlainHeaders(h) {
    return h !== null && typeof h === 'object' && !Array.isArray(h)
}
if (!isPlainHeaders(headers)) throw new Error('headers must be a plain object')

Type guard

function isHeaderRecord(h) {
    return h !== null && typeof h === 'object' && !Array.isArray(h)
}

Try / catch

try {
    validateCustomHeaders(headers)
} catch (e) {
    if (/expected an object/i.test(e.message)) headers = {}
    else throw e
}

Prevention

Always default to {} at API boundaries instead of forwarding null/undefined.
Reject arrays explicitly — validateCustomHeaders does not.
Validate the shape of parsed JSON before forwarding it as headers.

When it happens

Trigger: Caller passes null, undefined, a string, a number, or a boolean where a Record<string,string> was expected.

Common situations: JSON.parse of an empty body returns null and is forwarded; wrong variable passed in; a deserializer returning a primitive instead of an object; optional field never populated.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/3e21a3451d46aba8. Report an issue: GitHub.