Mintplex-Labs/anything-llm · warning

[EmbedConfig] Embed ${embed.uuid} was created with no allowe

Error message

[EmbedConfig] Embed ${embed.uuid} was created with no allowed-domains allowlist; it will accept requests from ANY origin. Set EMBED_REQUIRE_ALLOWLIST="true" to require an allowlist before an embed will respond.

What it means

A chat embed was created with allowlist_domains null while EMBED_REQUIRE_ALLOWLIST is not present in the environment. Without an allowlist the embed script will respond to requests from ANY origin — any website can embed this workspace's chat and query it — so the model creation path warns about the open posture.

Source

Thrown at server/models/embedConfig.js:76

            data?.message_limit,
            "message_limit"
          ),
          createdBy: creatorId != null ? Number(creatorId) : null,
          workspace: {
            connect: { id: Number(data.workspace_id) },
          },
        },
      });

      // If the embed was created with no allowed-domains allowlist
      // and the EMBED_REQUIRE_ALLOWLIST environment variable is not set, warn the user
      // since this would mean the embed will accept requests from ANY origin.
      // If the ENV is set, then it would just mean the embed wont respond to requests from ANY origin.
      if (
        !embed.allowlist_domains &&
        !("EMBED_REQUIRE_ALLOWLIST" in process.env)
      ) {
        console.warn(
          `[EmbedConfig] Embed ${embed.uuid} was created with no allowed-domains allowlist; it will accept requests from ANY origin. Set EMBED_REQUIRE_ALLOWLIST="true" to require an allowlist before an embed will respond.`
        );
      }
      return { embed, message: null };
    } catch (error) {
      console.error(error.message);
      return { embed: null, message: error.message };
    }
  },

  update: async function (embedId = null, data = {}) {
    if (!embedId) throw new Error("No embed id provided for update");
    const validKeys = Object.keys(data).filter((key) =>
      this.writable.includes(key)
    );
    if (validKeys.length === 0)
      return { embed: { id: embedId }, message: "No valid fields to update!" };

View on GitHub (pinned to 3aec848f28)

Solutions

1. Edit the embed and set allowed_domains to the origins that should host it.
2. Set EMBED_REQUIRE_ALLOWLIST="true" in the server environment so embeds without an allowlist never respond.
3. Audit existing embeds for missing allowlists after enabling the flag.
4. If the embed is meant to be public, accept the warning but ensure the workspace contains no sensitive content.

Example fix

# before
# (no env set, embed created with empty allowlist)

# after
EMBED_REQUIRE_ALLOWLIST="true"

// Guard embed creation in product code:
if (!data.allowlist_domains?.length && process.env.EMBED_REQUIRE_ALLOWLIST !== 'true') {
  console.warn('Creating an embed open to ALL origins — confirm this is intended');
}

function embedHasAllowlist(embed) {
  return Array.isArray(embed.allowlist_domains) && embed.allowlist_domains.length > 0;
}

When it happens

Trigger: Creating an embed via the UI without adding allowed domains; POSTing the embed API without allowlist_domains; deploying to production with the same env as development (where the variable was never set).

Common situations: Quick demos where the embed was made without thinking about origins; copied env configs that omit EMBED_REQUIRE_ALLOWLIST; public workspaces exposed unintentionally through embeds on third-party sites.

Related errors

• Invalid request.
• No LocalAI Base Path was set.
• No LocalAi token context limit was set.
• Unknown provider: ${config.provider}. Please use a valid pro
• Type "${type}" is not a valid type to sync.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/0b0b3d5b7030b756. Report an issue: GitHub.