MagicMirrorOrg/MagicMirror · warning

Invalid whitelist entry

Error message

Invalid whitelist entry: ${entry}

What it means

In isAllowed, each whitelist entry is parsed with ipaddr.process and compared against the client IP. If an entry cannot be parsed as a valid IP address or CIDR range, the entry throws, is caught, logged as this warning, and the entry is treated as not matching (returns false for that entry).

Solutions

1. Replace the invalid entry with a valid IP or CIDR range: e.g. "127.0.0.1", "::1", "192.168.1.0/24".
2. Test the entry with ipaddr.js first: ipaddr.process('192.168.1.0/24') in a node REPL.
3. Use ipWhitelist: [] to allow all clients if you intend no restriction.
4. Remove leftover wildcard '*' entries — CIDR notation is the supported way to allow ranges.

Example fix

// before (config.js)
ipWhitelist: ["127.0.0.1", "192.168.1.*"]
// after
ipWhitelist: ["127.0.0.1", "::1", "192.168.1.0/24"]

const ipaddr = require("ipaddr.js");
function validateWhitelist(list) {
  list.forEach(entry => {
    try { ipaddr.process(entry); }
    catch { throw new Error(`Invalid whitelist entry: ${entry}`); }
  });
}
// call at startup: validateWhitelist(config.ipWhitelist)

function isParsableAddress(entry) {
  try { ipaddr.process(entry); return true; }
  catch { return false; }
}

try {
  const allowed = ipaddr.process(entry);
  return clientAddr.toString() === allowed.toString();
} catch {
  Log.warn(`Skipping invalid whitelist entry: ${entry}`);
  return false;
}

When it happens

Trigger: ipAccessControl whitelist (or server config ipWhitelist) contains a malformed entry — e.g. '192.168.1.*' wildcards, hostnames, 'localhost', or a typo like '192.168.1.300' — that ipaddr.process cannot parse.

Common situations: Users copying old wildcard-style whitelist entries ('::ffff:127.0.0.1' is fine but '127.0.0.*' is not); using DNS names instead of IPs; leftover commas or whitespace artifacts from editing.

Related errors

• IP is not allowed to connect to the mirror socket
• Failed to parse client IP
• <!DOCTYPE html> <html lang="en">
• Forbidden: domain not in corsDomainWhitelist
• Forbidden: private or reserved addresses are not allowed

AI-assisted analysis of MagicMirrorOrg/MagicMirror@4b4a59534f (2026-08-31). Data as JSON: /api/errors/cd50d251ca22e2ed. Report an issue: GitHub.

Appendix: source

Thrown at js/ip_access_control.js:26

 * @returns {boolean} True if IP is allowed
 */
function isAllowed (clientIp, whitelist) {
	try {
		const addr = ipaddr.process(clientIp);

		return whitelist.some((entry) => {
			try {
				// CIDR notation
				if (entry.includes("/")) {
					const [rangeAddr, prefixLen] = ipaddr.parseCIDR(entry);
					return addr.match(rangeAddr, prefixLen);
				}

				// Single IP address - let ipaddr.process normalize both
				const allowedAddr = ipaddr.process(entry);
				return addr.toString() === allowedAddr.toString();
			} catch {
				Log.warn(`Invalid whitelist entry: ${entry}`);
				return false;
			}
		});
	} catch {
		Log.warn(`Failed to parse client IP: ${clientIp}`);
		return false;
	}
}

/**
 * Resolves a client IP for both Express and Socket.IO requests.
 * If the direct peer is loopback, trust the first X-Forwarded-For value (local reverse proxy case).
 * Otherwise ignore X-Forwarded-For to prevent spoofing.
 * @param {object} req - Incoming request object (Express request or Socket.IO handshake request)
 * @returns {string} The resolved client IP address
 */
function resolveClientIp (req) {
	const directIp = req.socket?.remoteAddress || req.connection?.remoteAddress || req.ip;

View on GitHub (pinned to 4b4a59534f)