Remote "extends" URL targets a disallowed host: ${url.href}

Error message

Remote "extends" URL targets a disallowed host: ${url.href}

What it means

Error "Remote "extends" URL targets a disallowed host: ${url.href}" thrown in Kong/insomnia.

Source

Thrown at packages/insomnia/src/main/bundle-spectral-ruleset.ts:88

function parseRemoteExtendsUrl(entry: string, base?: URL): URL {
  try {
    return new URL(entry, base);
  } catch {
    throw new Error(`"extends" entry "${entry}" is not a valid spectral identifier, local path, or URL.`);
  }
}

// Rejects URLs that could be used for SSRF attacks:
// - Must be https (no http, ftp, file, etc.)
// - Hostname must not be a known private/loopback address
// - DNS resolution must not yield a private/loopback address
async function assertSafeRemoteUrl(url: URL): Promise<void> {
  const hostname = url.hostname.toLowerCase();
  if (url.protocol !== 'https:') {
    throw new Error(`Remote "extends" URL ${url.href} must use https`);
  }
  if (!hostname || isPrivateOrLoopbackHost(hostname)) {
    throw new Error(`Remote "extends" URL targets a disallowed host: ${url.href}`);
  }
  // The literal hostname can still resolve to an internal address (e.g. *.localtest.me → 127.0.0.1).
  const records = await dns.lookup(hostname, { all: true });
  for (const { address } of records) {
    if (isPrivateOrLoopbackHost(address.toLowerCase())) {
      throw new Error(`Failed to resolve host. "${url.href}" resolves to a private or loopback address.`);
    }
  }
}

// Fetches and parses a remote ruleset over the network. The URL is SSRF-checked before
// any network call is made. Redirects are rejected because a redirect could forward us
// to an internal host that bypassed the assertSafeRemoteUrl check.
async function readRemoteRuleset(url: URL): Promise<Ruleset> {
  await assertSafeRemoteUrl(url);

  let response: Response;
  try {

View on GitHub (pinned to d9bb2b0142)

When it happens

Trigger: Thrown at packages/insomnia/src/main/bundle-spectral-ruleset.ts:88 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/a6f4a22552922ab3. Report an issue: GitHub.